“Mandatory Harassment Prevention for Employees” Phishing

Phishing message example:

'Mandatory Harassment Prevention for Employees' phishing message
Message Body: Good morning, Our records show that your Discrimination & Sexual Harassment Training will expire within 24hrs. At the Training Calendar you will find a guide on how to determine which training you are required to take (in-person / Live Virtual or online). *If you have already registered for a session, thank you, please disregard the notification.* The Discrimination and Sexual Harassment Prevention training sign up/registration can be found in our new training system, Training Calendar under the Course Catalog. *Please note this notification reflects data received up to September 27. If the training was taken after September 27, we ask that you visit Training Calendar, and Login to confirm you already completed the training. The Anti-Harassment Policy requires: Every non-supervisory employee must attend the County’s “Discrimination and Sexual Harassment Prevention Training for Employees” upon hire and every year thereafter during the course of their employment with the County. While non-supervisory employees have the option of completing the training online via the County’s intranet, it is required that in-person trainings are completed at least every other training to ensure a thorough understanding. Every supervisor must attend the County’s “Discrimination and Sexual Harassment Prevention Training for Supervisors” upon hire and every year thereafter during the course of their employment with the County. Supervisors do not have the option of completing the training online and must attend an in-person training each time the training is due. Your attention to this matter is greatly appreciated.

Clues that it is a phishing message:

  • The sender is not from a department that would normally send the message.
  • This type of message would normally come from a department, such as HR and not a user is an unrelated department.
  • The recipient is taken to a fake Outlook login page.
  • The recipient is not listed directly, but blind copied.
  • The URL is for for a PK domain, which SMU does not use.
  • The email is pressuring with its sense of urgency.
  • There is no signature or contact information.