Beware of phishing emails in the name of the boss

In many companies, there are currently increasing reports of Phishing mailsthat appear to come from superiors or the management. Particularly insidious: these messages are often worded as if they came directly from your own boss - with name, title and sometimes even the appropriate signature. The content appears urgent and confidential, for example:

"Hello, do you have a minute? I need your mobile phone number for an urgent matter."

What sounds harmless is often the beginning of a Social engineering attack - In other words, an attempt to deliberately manipulate people in order to obtain confidential information or to cause even greater damage later on.

Why are these emails dangerous?

• Identity misuse: Criminals pretend to be superiors in order to exploit the trust of recipients.

• Data theft: The mobile phone number can be used to try to commit identity theft or bypass two-factor authentication, among other things.

• Follow-up attacks: Once you have replied, you are often involved in further fraudulent communication - e.g. with requests to buy voucher codes or make bank transfers.

How can you recognise such phishing emails?

1. Unusual e-mail address: The sender's address appears legitimate at first glance, but on closer inspection you can recognise small deviations (e.g. [email protected] instead of firma.de).

2. Urgency and confidentiality: The message demands immediate action, often with the advice not to share the information with others.

3. Unusual enquiry: A superior does not normally ask for your private mobile phone number spontaneously by e-mail - especially not without context.

4. No personal style: The language often seems atypical or distanced, sometimes bumpily formulated.

5. No direct contact: Calling directly or making a personal appointment is avoided - because the sender cannot do this.

What should you do?

• Do not release any data! Never send sensitive information by email or messenger without clearly verifying the sender.

• Ask questions: If in doubt, always ask the person concerned by telephone or in person.

• Forward mail: Report suspicious emails to the IT department or the responsible security office in the company.

• IT security training: Inform employees regularly about current scams.

Conclusion

Phishing emails purporting to come from the boss are no longer an isolated incident, but a widespread trick used by cyber criminals. Vigilance, common sense and a quick check-up call can prevent a lot of damage.