Would you reimburse an employee who fell for a phishing scam?

[Anonymous]

What happened to the gift cards?
Any chance the employee is the scammer?

[Anonymous]

Anonymous wrote:In the email warning you sent to employees, did you explicitly make it clear that the phishing emails could appear to come from specific people in your own company from their actual email addresses?

Your IT department sucks, by the way.

This is the OP. Yes, the warning email specifically outlined the scenario of an email coming from a leader in the company asking for money or gift cards.

[Anonymous]

Anonymous wrote:What happened to the gift cards?
Any chance the employee is the scammer?

No

[Anonymous]

Anonymous wrote:Was the email domain spoofed?

No, the name was the CEO but the email address was a gmail account.

[Anonymous]

Anonymous wrote:

Anonymous wrote:In the email warning you sent to employees, did you explicitly make it clear that the phishing emails could appear to come from specific people in your own company from their actual email addresses?

Your IT department sucks, by the way.

This is the OP. Yes, the warning email specifically outlined the scenario of an email coming from a leader in the company asking for money or gift cards.

Fire that dumb employee -- he's an obvious threat to your company.

[Anonymous]

Yes

[Anonymous]

I agree with PPs who think your IT department had a big fail here. The employee should have known better but your IT department failed, you have insurance and you can deduct the cost as a business expense. How small are you, exactly? Is the employee older? Hourly worker? Low compensation? I would probably reimburse a portion.

[Anonymous]

Most of these comments are appalling.

Yes, reimburse the employee. The email came to her work account with the Ceo’s name as sender. How is this even a question?

Oh, and improve your spam filter/anti-phishing technology

[Anonymous]

Anonymous wrote:

Anonymous wrote:In the email warning you sent to employees, did you explicitly make it clear that the phishing emails could appear to come from specific people in your own company from their actual email addresses?

Your IT department sucks, by the way.

This is the OP. Yes, the warning email specifically outlined the scenario of an email coming from a leader in the company asking for money or gift cards.

Well, that’s really weird that a spammer used that exact same scenario. I’d be more than a little suspicious that it was some sort of inside job.

[Anonymous]

Anonymous wrote:

Anonymous wrote:In the email warning you sent to employees, did you explicitly make it clear that the phishing emails could appear to come from specific people in your own company from their actual email addresses?

Your IT department sucks, by the way.

This is the OP. Yes, the warning email specifically outlined the scenario of an email coming from a leader in the company asking for money or gift cards.

Well, in that case, your IT department still sucks, you should still reimburse the employee (because they are out money incurred as a result of your incompetence) and then I'd look to get rid of that employee for their own incompetence.

[Anonymous]

Anonymous wrote:This is the OP. The staff member gave the scammers the gift card numbers and codes, they have all been used, there is zero balance on them.

I want to be humane, but we are small company. I would feel slightly more inclined if it wasn't for the fact that we had specifically warned people about this less than two weeks ago.

No, I wouldn't pay the employee back. This is a good time for the employee (and you) to step back and ask why didn't the employee question such a request? Why would a CEO need an employee to use their personal funds to purchase gift cards? And if the employee doesn't apply common sense in this situation, what other kind of situations would he/she also follow blindly?

[Anonymous]

Anonymous wrote:

Anonymous wrote:

Anonymous wrote:In the email warning you sent to employees, did you explicitly make it clear that the phishing emails could appear to come from specific people in your own company from their actual email addresses?

Your IT department sucks, by the way.

This is the OP. Yes, the warning email specifically outlined the scenario of an email coming from a leader in the company asking for money or gift cards.

Well, in that case, your IT department still sucks, you should still reimburse the employee (because they are out money incurred as a result of your incompetence) and then I'd look to get rid of that employee for their own incompetence.

No, the IT department can only do so much.

[Anonymous]

I'm a pretty tech saavy person, but in a job that I don't feel like I have 100% of the confidence of my boss. I also got this email a few weeks ago, it starts with a desperate need for help. If you aren't in a place where you feel like your boss is looking out for you, I can see how the employee can fall for it. The initial email is "Hey J, I'm in a meeting I can't pull out of, are you free to help me with something?!" Most employees would reply back sure what's up Luckily, once I got the reply back re the gift cards (it's in a 2nd or 3rd email) I took the time to check with my IT department and note a spoof email.

[Anonymous]

I can't believe some of the responses here.

Of course you reimburse the employee. While the employee sounds gullible and needs a stern warning, this sounds more like an IT fail than anything else. I also agree with the PPs that this $2000 would be a huge part of a lower level employee's pay. Use the gift cards for another reason (for use by travelers to pay for air fare or hotels, etc.) and look at it as a zero net impact. You haven't lost any money and you haven't made any money. And get your IT department to beef up its monitoring systems.

[Anonymous]

Anonymous wrote:I'm a pretty tech saavy person, but in a job that I don't feel like I have 100% of the confidence of my boss. I also got this email a few weeks ago, it starts with a desperate need for help. If you aren't in a place where you feel like your boss is looking out for you, I can see how the employee can fall for it. The initial email is "Hey J, I'm in a meeting I can't pull out of, are you free to help me with something?!" Most employees would reply back sure what's up Luckily, once I got the reply back re the gift cards (it's in a 2nd or 3rd email) I took the time to check with my IT department and note a spoof email.

We had 4 people receive texts like this at my workplace in the fall. It was during the workday but while the head was away at a meeting. 3 of us responded asking for confirmation and more information while 1 person, who works most closely with the head, went out and did what was requested. Lesson learned for all of us.