Imagine going about your daily routine when you receive an urgent message from the CEO requesting your immediate help. The CEO is currently attending customer visits, and due to someone else’s mistake, gift cards have not been provided as promised. The CEO requests that you purchase six £200 gift cards and share the details via text message promptly.
The message sender assures you that they will reimburse you before the end of the day. Additionally, they will be unavailable for the next two hours due to meetings, and this is a high-priority request that needs urgent attention.
Victims of this scam end up losing their cash. Without proper training, studies show that up to 32.4% of employees are susceptible to falling for phishing scams.
Why do employees fall for phishing scams?
Social engineering tactics are frequently employed by hackers to manipulate emotions and influence employees to comply with their requests. Such tactics include:
- Instilling fear of not obeying a superior’s order
- Offering the opportunity to be a hero and save the day
- Creating a sense of loyalty to the company
- Appealing to an employee’s ambition by offering potential career advancement
Phishing messages are also crafted in a way that induces the employee to act without thinking or verifying. Typically, the message conveys a sense of urgency, indicating that the CEO needs the gift card details immediately. Furthermore, the message often states that the CEO will be unavailable for the next few hours, making it difficult for the employee to verify the legitimacy of the request with the actual CEO.
To avoid falling for phishing scams, it is crucial to double-check any unusual requests or those involving money, regardless of the message’s claims about unavailability. To verify the legitimacy of a request, reach out to the person through other means, such as phone or in person.
It is also essential to avoid reacting emotionally to a message and instead take a few moments to analyze it objectively. Ask yourself if the request seems legitimate or out of the ordinary.
Furthermore, seeking a second opinion from a colleague or your company’s IT service provider can help prevent you from making a costly mistake. By delaying your reaction and getting a second opinion, you can avoid falling victim to a phishing scam.
Do you require assistance with employee phishing awareness training? Get in touch.