It was a typical day at the office. Connor was checking his inbox when he saw an email from Sarah from HR titled, "Important Dress Code Updates". He was intrigued. Did something happen with the current dress code? What changes were going to be?
Connor opened the message. It said he must sign a document to show he has read the new policy. There was a link in the message to the new policy and a document to sign. When he clicked the link, he was brought to a website that asked him to make an account. Connor figured it must be a new website HR was using. He entered his phone number, birth date, and other details to sign up.
Once the information was submitted, the screen didn't show the new dress code policy. Frustrated, Connor went over to Sarah's office to ask her about it in person. After talking to Sarah, Connor was shocked to find out she knew nothing about the email.
Did you spot the red flags?
- Connor didn't check the sender's email address. He saw it was "Sarah from HR" and didn't look closer.
- Instead of checking with someone first about the new website, Connor entered all of his personal information.
- Connor let his emotions get the best of him. Cybercriminals often push us to act with "important" messages about topics we expect to see from work.
What you should know about this scam
Always examine the sender's email address closely, even if the name looks familiar. Walk through the SLAM method (sender, links, attachments, message) before acting.
Scammers will create a sense of urgency and call a user to action. Common examples ask a user to sign a document, view an update, or complete an urgent work-related task.
2022 saw an increase in work-related scam emails. Before clicking any links or attachments, check with the person directly to make sure the message is from them. Even if the message appears to be from a website your company uses, it is best to check before clicking any links or entering any information.