{"id":20813,"date":"2023-03-14T20:00:43","date_gmt":"2023-03-14T16:00:43","guid":{"rendered":"https:\/\/me-en.kaspersky.com\/blog\/new-employee-scam\/20813\/"},"modified":"2023-03-14T20:00:43","modified_gmt":"2023-03-14T16:00:43","slug":"new-employee-scam","status":"publish","type":"post","link":"https:\/\/me-en.kaspersky.com\/blog\/new-employee-scam\/20813\/","title":{"rendered":"How too-eager-to-please new employees get scammed"},"content":{"rendered":"

The first few days in a new workplace are commonly packed with team meetings, trainings, onboarding sessions, and so on. Much ado with little understanding of what\u2019s going on. At the same time there are certain \u201crituals\u201d that many new hires go in for these days \u2014 one of which being posting on social media (most commonly, but not exclusively, on LinkedIn) about starting a new job. Often, companies themselves announce there how happy they are to welcome a new team member. And that\u2019s when the freshly minted employee attracts the attention of scammers.<\/p>\n

As a rule, such social-media posts give the names of both the employee and the company, as well as the job title. This is usually enough to identify the new person\u2019s manager (through the same social network or the corporate website). Knowing the names, you can either find or figure out their e-mail addresses. Firstly, there are lots of e-mail lookup tools to help with this. Secondly, many companies simply use the employee\u2019s first name, or first and last names, as their e-mail usernames, so all that\u2019s needed is to check which system is in use to be able to work out the address. And once they\u2019ve got your e-mail, then it\u2019s time for some social engineering<\/a>.<\/p>\n

Task one: transfer money to scammers<\/h2>\n

For the first few days in a new job the employee is likely not quite up to speed, yet keen to appear so in the eyes of colleagues and superiors. And this can lower the new employee\u2019s vigilance: they hastily carry out most any task without stopping to think where it came from, whether it sounds reasonable, or whether it\u2019s their business at all. Someone wants it done, so done it must be. This is especially true if the instruction came from their immediate supervisor or even one of the company founders<\/a>.<\/p>\n

Scammers exploit this to trick new employees. They send an e-mail supposedly from the boss or someone senior (but using a non-company address) asking the employee to do a task \u201cright away\u201d. The newbie, of course, is happy to oblige. The task might be, say, to transfer funds to a contractor or purchase gift certificates of a certain value. And the message makes clear that \u201cspeed is of the essence\u201d and \u201cyou\u2019ll be paid back by the end of the day\u201d (of course!). Scammers highlight the urgency so as not to give the employee time to think or check with someone else.<\/p>\n

The boss has an air of authority, and the employee wants to be of use. So, they don\u2019t stop to query the rationale, or why they in particular have been chosen to perform the task. The victim transfers the money to the specified account without hesitation and reports back to the \u201cboss\u201d at the same e-mail address \u2014 again failing to spot that the domain name looks suspicious.<\/p>\n

The scammer continues to play the role of the big boss: they ask for documents confirming the transaction, and, after receiving them, praise the employee and say that they\u2019ll forward the documents to the initiator of the order (which adds a sense of legitimacy). To complete the feeling of a normal workplace interaction, the attackers also say they\u2019ll be in touch again if anything more is needed from the (hapless) employee.<\/p>\n

Only after some time does the employee either start to wonder why they were assigned the task, spot the non-company e-mail address, or mention the incident in conversation with the real boss. Then the sad truth dawns: it was a scam.<\/p>\n

Aggravating circumstances<\/h2>\n

Like other work-related scams<\/a>, this scheme has benefited from the mass shift to remote working. Even small companies have started hiring from around the world, meaning that some new employees may not only not know what their boss looks and sounds like \u2014 but have no way of quickly clarifying with a co-worker, even if they wanted to, whether the task looks to be on the level.<\/p>\n

What\u2019s more, if the supervisor and most of the other employees work in different countries, a request to transfer money to someone in your region could feel very plausible. Domestic bank transfers are always easier and faster than international ones, which lends a veil of normalcy to the scam request.<\/p>\n

Finally, smaller companies, which seem to be common targets, tend to have less formal money-handling procedures in place \u2014 without form-filling or financial controllers: just send it now, put it on your expenses, and you\u2019ll get it back in a bit. This is another factor that imparts legitimacy to scam e-mails.<\/p>\n

How employees can avoid the trap<\/h2>\n

The most important thing for a new employee is not to lose their head trying to be of service to the company.<\/p>\n