The woman offering flu shots (search) for $20 in the commons area at Augsburg college seemed plausible enough — green scrubs, white lab coat, stethoscope — that some three dozen people willingly paid their money, rolled up their sleeves and let her plunge the needle in.

But no one had scheduled a flu clinic. No one knew who the woman was. And no one could be sure what was in those syringes.

She turned out to be 33-year-old Michelle Torgerson (search), a freelancing nurse who claims she was selling leftover vaccine to raise money for a fund-raiser at her daughter's school. And those shots were certainly nothing sinister, if not just plain old flu shots, lab tests have found.

But in an age when bioterrorism (search) experts worry about sophisticated attacks, the case shows how anyone with a syringe and a reasonable looking get-up can have potential victims lining up — even paying — to be injected with who-knows-what.

"Imagine if they hadn't been able to track her down, and they had no idea, and somebody had just come onto a college campus injecting people with something," said Dr. Michael Osterholm, a bioterrorism expert with the National Center for Food Protection and Defense at the University of Minnesota.

Osterholm said it's not realistic to expect patients to challenge the credentials of every nurse who administers a flu shot — but he said the school should have. "I think this really is at the center of the discussion about what does it mean to recognize and report suspicious behavior," he said.

On Dec. 2, a staffer confronted Torgerson, asking who she was and who her supervisor was, according to Augsburg security director John Pack.

Pack said he and another security worker headed toward the commons to investigate. "At that point I wasn't thinking whether or not it was malicious or a mixup," Pack said. "I was thinking about the scope — I wondered how many people received shots."

Torgerson, of suburban Albertville, had left the campus promising the staffer she would provide the name of a supervisor, Pack said. But the security director said she never did, further raising suspicions.

Torgerson gave a different account Sunday, saying she did speak briefly to an administrator named "Diane," but that she wasn't challenged. She said she left after the noon hour, as she had planned, and did not "abruptly" leave, as officials have said.

Pack called police, and then set about trying to find out how many people had been injected. He sent an e-mail alert to everyone on campus, and printed red fliers asking anyone who had gotten the shots to come forward. Teachers read the alert in class the next day.

Police arrested Torgerson the day after the injections were discovered, near her ex-husband's home in Belgrade, 90 miles away from the college.

Torgerson, a licensed practical nurse who had given immunizations as part of a legitimate clinic at Augsburg last month, insisted Sunday she did nothing wrong. She said she believed she did have permission from an Augsburg administrator in charge of the student center to give the flu shots on her most recent visits to the school.

Torgerson has not been charged.

But some students are going in for HIV tests anyway, and about 100 attended a meeting in the school's chapel last week where police and health workers answered questions. Augsburg president William Frame apologized. Some students were mollified, while others remained angry.

According to the Minnesota Department of Health, test results that came back Friday from the Food and Drug Administration showed the vials police took from Torgerson contained real flu vaccine, but the vaccine in some vials had been watered down with saline solution.

On Sunday, Torgerson emphatically denied diluting the vaccine, and her lawyer disputed the accuracy of the test results, saying they'll bring in their own experts.

Torgerson, who had worked at several immunization clinics, has said her employer told her to dispose of the leftover vaccine. Employer Maxim Healthcare Services of Columbia, Md., said Torgerson was told to return all her unused vaccine by Nov. 12, the day after her last authorized flu clinic.

Torgerson disputed that too, saying her supervisor told her was trying to line up other flu shot clinics.

Some bioterrorism experts said it's tough to guard against a theoretical threat like someone impersonating a nurse and injecting victims with something toxic.

"Society operates at a certain level of trust, and I think it's very difficult to really police ... any sort of activity like this very extensively," said Dr. D.A. Henderson, a senior adviser at the Center for Biosecurity at University of Pittsburgh Medical Center.

"There are reasonable fears that we have, and there are a million potential things that we could imagine someone might do if they really were nasty about it," he said.

Augsburg now requires outside vendors to display a permit. But Pack said Torgerson seemed to be trying to answer the staff person's questions, even promising to call back with the name of a supervisor.

"She certainly acted like she belonged," he said.