4 ms·

One that was successful at my company recently was an e-mail sent to an electrical engineer from the CEO saying that the CEO needed a gift card from Target for

One that was successful at my company recently was an e-mail sent to an electrical engineer from the CEO saying that the CEO needed a gift card from Target for an employee birthday, and had forgotten to pick it up. The EE went to Target and bought the card. The instructions including to reply to the e-mail with the card # so the CEO could include the number in the birthday card and not need the actual plastic. The spoof was believable at first glance. It used the CEOs actual first name and obscured the actual source e-mail address with his company e-mail as the name. What should have given the engineer pause (among other things) was the context. There was no reason that the CEO would ask an engineer to do this task at my company. Nonetheless, the engineer was perhaps overly deferential to the chain of command and the suspicion didn't emerge until he had embarrassed himself.

Aeolun 6y ago
Hah, I almost fell for the same thing, but when they asked for 4! $1000 codes! over email! I got a bit suspicious. Could have probably gotten 4 times $50 out of me though.
pwillia7 6y ago
That's rough. I got a phishing email from my CEO asking about something similar with money and had a brief 'oh shit' chain of command moment before my incredulousness kicked in. I get it.
mlang23 6y ago
Simple. Either call or reply asking him why he didn't send this mail to the secretary. If you can't be so direct with your boss, find another job.
- 11thEarlOfMar 6y ago
  In this case, it was his boss's boss's boss (I am his boss's boss). This particular engineer is highly valued at the company, including by me personally. It was at the same time surprising, but paining to see his consternation, and I certainly do hope he doesn't leave us. I'll gladly endure a $100 mistake to have his talents and attitude as an engineer.
zrobotics 6y ago
We had an employee fall for this exact scam, the only reason it failed is we are a smaller company so rather than reply our employee physically handed the cards to our CEO. She had bought 2k worth of target gift cards. Needless to say, our CEO was very confused. I looked at the phishing email, and in Gmail it looked very legit, since by default the email address isn't visible. The email had the correct first & last name of the CEO, only clicking on the header showed the from email didn't match our CEOs email. I was shocked that a company as small as ours was targeted, this phishing attempt was clearly not bot generated and the English in the email was very good, the only thing that was fishy was the request for gift cards.
- mlang23 6y ago
  I've recently also heard "the email address is not visible by default" in a postmortem. This is a UX problem which leads to increased vulnerability. It needs to be fixed.

Aeolun 6y ago

Hah, I almost fell for the same thing, but when they asked for 4! $1000 codes! over email! I got a bit suspicious. Could have probably gotten 4 times $50 out of me though.

pwillia7 6y ago

That's rough. I got a phishing email from my CEO asking about something similar with money and had a brief 'oh shit' chain of command moment before my incredulousness kicked in. I get it.

mlang23 6y ago

Simple. Either call or reply asking him why he didn't send this mail to the secretary. If you can't be so direct with your boss, find another job.

11thEarlOfMar 6y ago
In this case, it was his boss's boss's boss (I am his boss's boss). This particular engineer is highly valued at the company, including by me personally. It was at the same time surprising, but paining to see his consternation, and I certainly do hope he doesn't leave us. I'll gladly endure a $100 mistake to have his talents and attitude as an engineer.

zrobotics 6y ago

We had an employee fall for this exact scam, the only reason it failed is we are a smaller company so rather than reply our employee physically handed the cards to our CEO. She had bought 2k worth of target gift cards. Needless to say, our CEO was very confused. I looked at the phishing email, and in Gmail it looked very legit, since by default the email address isn't visible. The email had the correct first & last name of the CEO, only clicking on the header showed the from email didn't match our CEOs email. I was shocked that a company as small as ours was targeted, this phishing attempt was clearly not bot generated and the English in the email was very good, the only thing that was fishy was the request for gift cards.

mlang23 6y ago
I've recently also heard "the email address is not visible by default" in a postmortem. This is a UX problem which leads to increased vulnerability. It needs to be fixed.