First-day phishing

Phishing attempts succeed most when people are caught off balance, before their instincts for a new environment have developed. Any time you land in an unfamiliar situation, your chance of falling for an online scam goes up, because you don't yet know what's normal.

Real estate is a long-running example. Homebuyers are in the middle of a stressful, paperwork-heavy process involving several unfamiliar parties. When an email arrives with new instructions for transferring funds, it reads like one more step in the ordeal rather than the scam it actually is.

Selling something for the first time on Craigslist or Etsy works the same way. You'll quickly see a lot of promising offers that a veteran of those platforms would recognize as scams on sight. Because you don't yet know the conventions of the community, you're far more likely to make a mistake.

Congratulations on your new job

Along the same lines, we often see people hit with targeted phishing during their first week, or even their very first day, at a new job. An email asking a new hire to log in to a new online service, or an email that looks like it's from the boss asking them to buy gift cards, would look suspicious to a company veteran. Someone just starting won't see the warning signs.

A new employee hasn't settled into an organization's rhythms, standards, practices, or chain of command. They may already have several new services to sign in to, so what's one more? They might not know whether their CEO sometimes emails from a personal account, and they're eager to accommodate requests to make a good first impression.

That's why cybersecurity training belongs in a new employee's initial onboarding. And if you're a supervisor running that onboarding, make sure to give your new employee permission to ask as many questions as they need.

How did they know?

More than once, a client has told us their systems must have been hacked, because how else would a scammer know someone started a new job today?

As with most scams, it's not that complicated. There's a good chance the new hire posted to LinkedIn about the new role. We forget that social media isn't a private conversation between friends. LinkedIn is constantly mined by headhunters and marketers looking for an audience, and scammers are no different. They can scrape LinkedIn for "First day!" posts, learn a little about the company to guess the person's new email address and who their supervisor is, and start the scam.

How we help

We can set up your organization with cybersecurity training material and simulated phishing campaigns for ongoing threat awareness. Training employees on cyber hygiene, current threats, and how to respond to an incident is a key part of building a secure work environment.