HR related scams are on the rise: What you need to know

There’s been an increase in reported HR scams in Australia. 

An ongoing trend that is quite concerning is scammers are using HR-related email subjects to breach IT security. Essentially scammers are impersonating an HR department and using witty emails to lure employees into a trap. And plenty of employees are falling for it. Scammers use subject headings like:

• Important: Dress code changes
• Your training is past due 
• Invitation: Quarterly financial performance review 
• You’ve been assigned additional cybersecurity training 
• IT: Backup failed

These are effective because HR has authority in an organisation. Employees respect and are slightly afraid of HR! So when an employee receives an email from what looks like HR, they react first before thinking twice about interacting with the email.

HR is the scariest phishing tool in the scammers arsenal. Because you wouldn’t expect to receive an email from HR and the department holds a lot of power. So when users see HR, they snap to attention.

So what can HR do to avoid phishing attacks? 

Work with IT

Are you struggling to engage employees with dull and irrelevant IT training? Do employees bother turning up?

As the first and last point of contact for employees, HR plays a crucial role in fostering a strong security culture within your organisation. One of the most effective ways to protect your organisation from scams and protect employees is by working with your IT department.

Joint planning sessions between HR and IT can be a game changer. Together, you have the insights to tailor your training effectively, making it more engaging and relevant for your team.

HR's deep understanding of employee behaviour is invaluable in this process. Work with IT to develop a comprehensive scam awareness training program that also enhances general IT skills. This joint effort ensures that employees receive well-rounded training that covers both the technical aspects of cybersecurity and the specific company policies they need to follow.

This collaboration is essential for integrating cybersecurity awareness into the onboarding process. By doing so, new employees are equipped with the knowledge and skills to protect organisation assets from the moment they join the team.

By working with HR, you can boost engagement through personalised training. While essential security practices apply to everyone, advanced training should be tailored for technical staff and high-risk departments. This approach ensures the training is relevant to job roles, industry standards, and company policies. Customising the training enhances retention and increases the likelihood that your team will apply it in their day-to-day routines.

Educate employees 

Sometimes, context is everything. We somehow become more willing to change our behaviour if we understand the context, as we become more receptive to the advice we receive.

So one of the most effective ways to combat HR-related scams is by giving employees context about the real-life consequences of falling for these attacks. It's not just the company that's at risk—employees' own financial security and personal information are on the line.

Employees need to understand that these scams can have serious repercussions, not just for the company but for them personally. Identity theft, financial loss, and even the potential for job-related consequences are all on the table if they aren’t careful. By sharing real stories where employees have faced these issues, you can drive home the message that this isn’t just about following company policy—it's about protecting themselves.

When employees see the direct impact that a moment of inattention can have, they’re more likely to think twice before clicking on that seemingly harmless email. Educating them about these dangers isn't just a company obligation; it's about empowering them to protect their own interests.

Educate yourself 

Whether it's a quick email, a team meeting, or even a brief note, the goal is to make sure employees are always aware of what to watch out for. In larger companies, IT can communicate with HR to spread the word. In smaller companies, consider designating a cybersecurity officer.

It’s also essential to make reporting scams easy. Employees should know exactly how to report suspicious emails and feel confident in doing so. Regularly reinforcing your cyber policies, just like you would with any other workplace rule so employees know what to do when something feels off. 

Overall, creating a strong partnership with IT and building a cyber-safe culture can significantly reduce the risks of phishing attacks, protecting both your employees and your organisation.