Would you reimburse an employee who fell for a phishing scam?
![[Post New]](/jforum/templates/default/images/icon_minipost_new.gif){kind=icon}
Anonymous
|
Our company has been getting a lot of phishing emails lately. We are working hard with our IT vendors to deal with this and have sent two high priority emails to staff telling them to be careful, explaining what these scams are and what to look out for, and giving steps of what they should do if they receive one.
Over the weekend an employee got an email at their work email address that looked like it was coming from the CEO, asking them to purchase gift cards for him. The employee followed the instructions and wound up spending $2k of their own money on gift cards. When we discovered what happened we instructed the staff member to contact their credit card company, bank and the gift card vendor. All of these told him that since they bought the cards legitimately there is no recourse on their end. I instructed the employee to also file a police report. From the company perspective we do not feel that we should reimburse the staff member for this cost. I feel terrible for them, but we had sent warnings about this very scenario. Also, the request itself was not anything our CEO would ever ask a staff member to do, so the staff member really should have known better. Is there anyone that thinks the company should pay the staff member back? Is there anything else we can do? |
Anonymous
| Do you want to lose this employee? Yes, you should pay the employee back. He did this to be of service as part of his regular job duties. |
Anonymous
| Definitely not. Your employee is a moron. |
Anonymous
+1 |
Anonymous
| Your employee is an idiot, but if you can afford it, yes, I'd reimburse them. It's a lot of money and can break a person. |
Anonymous
| While I question the judgement of this employee- they did receive the request via a work email and stupid or not- they fulfilled the request. YES you need to pay them back. |
Anonymous
This. |
Anonymous
Agree. And work with your IT provider to do a better job of identifying spam emails. I would think a spoofed email address from your own domain should get caught by a filter automatically. |
Anonymous
Agree, it was an honest mistake on the employees part. Take the gift cards and give out if you have a picnic over the summer or at the holidays. They were an idiot for agreeing to use their own money but in many companies, including large ones, for things like travel you pay and get reimbursed SO this may be a normal thing to do at your company and in that case it made sense they did it. |
Anonymous
|
It's one thing to click on a link of a phishing email, it's another to spend $2k on gift cards at a fake CEO's request. I'm not sure how much this employee makes, but $2k is probably his/her bi-weekly take home. It's a lot of money to spend without asking around.
From a humane point of view, yes, you should reimburse him/her. From a business's stand point, do you want to set a precedent? |
Anonymous
| No way. They can use the gift cards themselves. |
Anonymous
| Where are the gift cards? |
Anonymous
| Somebody posted this exact same scenario but they were the employee. |
Anonymous
| My work overpaid me by 5k and I thought it was an award. I used the money to pay off my student loans. Work demanded the overpayment immediately, so I was stuck. This was the federal government. I'm sure they wouldn't care if I bought 2k worth of gift cards. |
Anonymous
|
The gift cards are gone, right? There's no money to recover?
I would reimburse the employee, but it's a serious lapse in judgement, particularly since you sent out emails warning against this specific scenario. It should definitely be reflected in their review. |