Cross-posted from Carpe Datum Law
Another week, another well-concocted phishing scam. The most recent fraudulent activity targeted businesses that use Workday, though this is not a breach or vulnerability in Workday itself. Specifically, the attack involves a well-crafted spam email that is sent to employees purporting to be from the CFO, CEO, or Head of HR or similar. Sometimes the emails include the name, title, and other personal information of the “sender” that we believe might be harvested from LinkedIn or other business databases. The email asks employees to use a link in the phishing email or attached PDF to log into a fake Workday website that looks legitimate. The threat actors who run the fake Workday website then use the user name and password to log into the Workday account as the employee and change their direct deposit bank/ACH information to another bank, relatable Green Dot, or similar credit card.
The fraud is typically only discovered when the employees contact HR inquiring as to why they did not receive their direct deposit funds. Unfortunately it appears that spam filters and other controls are failing to prevent this email from infiltrating the organization’s network.
In order to prevent this from happening to your organization, Workday has posted several “best practice” tips on their customer portal. The most impactful mitigation techniques include enabling and enforcing two factor authentication on your organization’s Workday instance, and changing your Workday settings to force administrative approval upon employee requests for direct deposit account change. Both of these will help secure your Workday environment and avoid employee loss of paychecks. Finally, always remember to train employees on fraudulent email identification through training and security drills/tests.