Would you reimburse an employee who fell for a phishing scam?

[Anonymous]

Reimbursing this employee sets a precedent. If there are future comparable incidents with other employees and at some point decide to stop paying, be prepared for questions about why you stopped at that particular employee.

[Anonymous]

Did any other employees get this exact phishing email? If not, maybe the employee was, indeed, in on it.

Another consideration is how much individual decision making the employee usually does. If it is someone who is basically following orders a lot, doing routine tasks, and supporting others, then I’d be more likely to reimburse because I wouldn’t expect them to have the same level skepticism about being given a task to do.

[Anonymous]

Anonymous wrote:

Anonymous wrote:
You need to reimburse because it was the first time and you did not adequately explain.

You convene a company wide meeting which all must attend, you explain what happened, and you say that in the future, no one will be reimbursed.

What was not adequately explained? There were warnings sent out. Are you saying that it should have been explicitly stated that if someone spent their own money on a scam they wouldn't be reimbursed?

Yes - or something along those lines explicitly warning employees not to spend their own funds on company requests.

Your IT security sucks. And yes your employee should have exercised better judgment, but there's a reason that phishing scams are still around - people fall for them.

I'd use this as a teaching and learning moment. You need an in-person all hands and new guidance to employees - don't use personal funds, any weekend tasking won't be via email, whatever.

I think not reimbursing the employee could badly damage morale. It's just not a good look that your staff is left holding the bag because your IT security is so poor that a scammer successfully impersonated your CEO to the tune of $2k.

[Anonymous]

Anonymous wrote:

Anonymous wrote:

Anonymous wrote:Our company has been getting a lot of phishing emails lately. We are working hard with our IT vendors to deal with this and have sent two high priority emails to staff telling them to be careful, explaining what these scams are and what to look out for, and giving steps of what they should do if they receive one.

Over the weekend an employee got an email at their work email address that looked like it was coming from the CEO, asking them to purchase gift cards for him. The employee followed the instructions and wound up spending $2k of their own money on gift cards. When we discovered what happened we instructed the staff member to contact their credit card company, bank and the gift card vendor. All of these told him that since they bought the cards legitimately there is no recourse on their end. I instructed the employee to also file a police report.

From the company perspective we do not feel that we should reimburse the staff member for this cost. I feel terrible for them, but we had sent warnings about this very scenario. Also, the request itself was not anything our CEO would ever ask a staff member to do, so the staff member really should have known better.

Is there anyone that thinks the company should pay the staff member back? Is there anything else we can do?

This is a great topic. You should take your question to Ask A Manager.
FWIW I don't think the employee needs to be reimbursed, because the company warned everybody (twice!) shortly before the incident.

Already been done. See #2: https://www.askamanager.org/2019/02/my-friend-is-bombarding-me-with-urgent-messages-while-im-at-work-i-fell-for-an-email-scam-and-more.html

Ask a Manager is spot on here.

[Anonymous]

Is the employee a solid performer other than this?

[Anonymous]

Anonymous wrote:

Anonymous wrote:

Anonymous wrote:
You need to reimburse because it was the first time and you did not adequately explain.

You convene a company wide meeting which all must attend, you explain what happened, and you say that in the future, no one will be reimbursed.

What was not adequately explained? There were warnings sent out. Are you saying that it should have been explicitly stated that if someone spent their own money on a scam they wouldn't be reimbursed?

Yes - or something along those lines explicitly warning employees not to spend their own funds on company requests.

Your IT security sucks. And yes your employee should have exercised better judgment, but there's a reason that phishing scams are still around - people fall for them.

I'd use this as a teaching and learning moment. You need an in-person all hands and new guidance to employees - don't use personal funds, any weekend tasking won't be via email, whatever.

I think not reimbursing the employee could badly damage morale. It's just not a good look that your staff is left holding the bag because your IT security is so poor that a scammer successfully impersonated your CEO to the tune of $2k.

IT security didn’t screw up. Jesus, how illerate are you people ? The person got an email from a gmail account FFS. The email impersonated someone. How would you expect IT to have stopped this?

[Anonymous]

Anonymous wrote:

Anonymous wrote:

Anonymous wrote:

Anonymous wrote:Our company has been getting a lot of phishing emails lately. We are working hard with our IT vendors to deal with this and have sent two high priority emails to staff telling them to be careful, explaining what these scams are and what to look out for, and giving steps of what they should do if they receive one.

Over the weekend an employee got an email at their work email address that looked like it was coming from the CEO, asking them to purchase gift cards for him. The employee followed the instructions and wound up spending $2k of their own money on gift cards. When we discovered what happened we instructed the staff member to contact their credit card company, bank and the gift card vendor. All of these told him that since they bought the cards legitimately there is no recourse on their end. I instructed the employee to also file a police report.

From the company perspective we do not feel that we should reimburse the staff member for this cost. I feel terrible for them, but we had sent warnings about this very scenario. Also, the request itself was not anything our CEO would ever ask a staff member to do, so the staff member really should have known better.

Is there anyone that thinks the company should pay the staff member back? Is there anything else we can do?

This is a great topic. You should take your question to Ask A Manager.
FWIW I don't think the employee needs to be reimbursed, because the company warned everybody (twice!) shortly before the incident.

Already been done. See #2: https://www.askamanager.org/2019/02/my-friend-is-bombarding-me-with-urgent-messages-while-im-at-work-i-fell-for-an-email-scam-and-more.html

Ask a Manager is spot on here.

No, not the same. They are different situations. In that case the email was spoofed and the employee wants to pay the company back. They said the employee should not have to pay the company back.

In OP’s case that email was not spoofed, it was a Gmail account. OP is asking if the company should reimburse the employee.

[Anonymous]

OP here. A few answers to questions:

--The employee who fell for the scam is under 40 and very computer literate.
--The email that they received was not truly spoofed, it had the CEO's name in the sender field but a gmail account attached to it.
--It is not customary in our company for anyone to ask for the purchase of gift cards and it is definitely not in the scope of the employee's job to do anything like this (which is why they don't have a work-issued credit card).
--We do have cyber insurance but this isn't covered because it was not the company's money that was lost, and the amount is also less than the per incident deductible.

In the end we decided to reimburse the employee half the amount they lost out of goodwill. I'm afraid the staff member will probably never recover in the eyes of the CEO, however.

We did do an immediate live training for all staff on cyber security and are still working on the back end to try to catch all of these emails before they reach staff, but now that someone has fallen for it we are getting hundreds of emails per day and a few still slip through.

[Anonymous]

Nice of OP to update us.

No, staff member won’t recover and probably shouldn’t. It’s so dumb. Especially when you realize at some point the CEO would have said “please just send me all the codes on the gift cards via email”, instead of “can you bring them to me?” ....

[Anonymous]

Anonymous wrote: The human side of me says you should reimburse half. The business side of me says you should not because they have been worn twice, it was a Gmail address, it was a ridiculous request, it was completely outside of her job duties, it shows a complete lack of judgment. And not that it matters that they’re under 40 but I would expect an older person to fall for such a scam but not somebody who is under 40 and has been around technology for many years.

Like I said, on a personal level I feel badly for the employee. If your company is able to afford it, perhaps reimburse half. Would it be tax-deductible at the end of the year? I would also hold an all company mandatory training ASAP about computer security, phishing etc.

Everyone is in a hurry, people do not slow down and READ, hence missing vital gmail address detail. I am 40 and young cashiers make me feel like an 80yr old if I take longer than a nanosecond to produce my payment at the register. Not completely analogous, but I use that example because we should all slow down, think, then act. Mistakes happen when we rush. I had a micromanager boss whose every third call was like something was on fire. What a pill. Amazingly, I still have my eyeballs after all of the eyerolls.

OP, I feel sorry for the employee, but it will be a good lesson for everyone at the company.