New starters do not know the unwritten rules. Attackers can exploit that gap
A new employee expects unfamiliar names, tools, and requests. Secure onboarding should make legitimate paths visible before an imposter defines them.
On a new employee’s first week, nearly every legitimate message looks unusual. They do not know which executive sends direct texts, how equipment is purchased, where payroll forms live, or whether IT uses a particular remote-support tool. The normal baseline that experienced colleagues use to detect anomalies has not formed yet.
Attackers can learn about a new role from public announcements and professional profiles. They can impersonate a manager, recruiter, IT technician, or HR partner and frame the request as one more unfamiliar onboarding step. Eagerness to be useful and reluctance to inconvenience senior colleagues make the timing effective.
The FTC’s July 2025 warning, “New job? How to spot boss imposter scams”, describes urgent gift-card and personal-information requests aimed at new hires. The preventive opportunity belongs to the employer: give the employee a trustworthy map before someone else supplies a fake one.
Novel people, channels, and tasks are expected, so anomaly detection is weak.
Publish known systems, named contacts, and requests the company will never make.
Invite verification and reward pauses instead of treating them as incompetence.
Establish the map on day zero
The first trusted interaction should explain where later interactions originate. Before the start date, recruiting can provide one stable portal or documented contact. On the first day, the manager can introduce HR, IT, and payroll channels in a live meeting or authenticated workspace.
The map should answer practical questions:
- Where are tax, identity, and bank details submitted?
- Who provides equipment, and will the employee ever pay a vendor personally?
- How does IT request remote support?
- Which messaging channels do leaders use?
- How are urgent purchases and payment changes approved?
- Where should a suspicious request be reported if the employee cannot access the main account?
Avoid a thirty-page policy that says only “be vigilant.” A one-page onboarding trust card with verified destinations is easier to use under pressure.
| New-hire moment | Plausible impersonation | Pre-established boundary |
|---|---|---|
| Before first day | Recruiter asks for bank or ID data in chat | Documents go only to named HR portal after formal hire |
| Equipment setup | Vendor asks employee to buy and await reimbursement | Company procurement ships equipment; no personal payment |
| First manager contact | Executive requests gift cards confidentially | Purchases require system approval; gift-card PINs are never sent |
| Account problem | “IT” asks for code or remote tool | Support begins from internal portal or known help number |
| Payroll setup | Direct message requests bank change | Employee initiates inside payroll system with confirmation |
Do not make public profiles the identity directory
New employees often announce roles online. Attackers can combine the company, manager name, location, and start date into a convincing pretext. The solution is not to blame the employee for celebrating. Employers should avoid publishing unnecessary onboarding detail and should explain how public information may be reused.
Internal identity checks should rely on authenticated directory records and known workspaces, not biographical facts. A caller who knows the manager’s title and current project may simply have read the same announcement.
The pretexting trust-chain analysis separates true background facts from the authority of the current request. A story can contain accurate names and still point to an unauthorized action.
Managers set the social permission to verify
During the first meeting, a manager can say: “I will never ask you to buy gift cards or send authentication codes. If I request an urgent exception, use the approval system or call me through the directory. You will not be penalized for checking.”
That statement does more than transfer knowledge. It changes the perceived cost of asking. The manager should respond consistently when the employee tests the promise. Mocking an unnecessary verification once can undo the whole message.
A newcomer cannot follow an unwritten rule safely. Either write the rule, or accept that someone else may write it for them.
Buddy systems help when the buddy’s role is explicit. Provide a named person outside the direct management line who can answer “Is this normal?” without approving the underlying transaction. Make sure that person is available across remote hours and understands escalation.
Design onboarding systems for hostile context
The HR portal should state what documents it needs and why, show the legal employer, and avoid asking employees to follow fresh links from email each time. Notifications can direct the person to open the portal independently. Changes to payroll or recovery details should trigger confirmation to established contacts.
IT enrollment should use phishing-resistant authentication where possible and bind devices through a documented workflow. Support should never ask for a password, backup code, or approval of an MFA prompt the employee did not initiate. The unexpected MFA prompt guide gives a simple deny-investigate-secure sequence that can be included in onboarding.
For remote equipment, procurement should own the vendor relationship. The FTC’s broader employment scam guidance warns about fake onboarding paperwork and early demands for personal data. A real employer can reduce ambiguity by never asking a new hire to move company money through a personal account.
Test the first-week experience
Ask recent hires to reconstruct the official routes without opening the policy: HR documents, payroll changes, IT support, manager verification, and incident reporting. Confusion is design evidence, not a training failure.
Run a tabletop using a realistic but harmless message. Measure whether the person can find the correct contact and whether the report receives a useful response. Do not grade only whether they spotted a typo. A message from a compromised real account may contain none.
Security teams should monitor new-account changes with context: new forwarding rules, recovery updates, unusual consent grants, impossible travel, and access beyond the role. Keep permissions minimal until needed rather than granting broad access on day one “for convenience.”
If a new hire reports a suspicious request, preserve the message, search for other recipients, and warn the cohort without naming or shaming the reporter. If information was disclosed, help with identity and account recovery immediately.
Make the reporting experience part of induction. The reporting-without-blame approach gives newcomers permission to report an incomplete concern early, before they have learned enough internal language to classify it perfectly.
Onboarding is where an organization teaches what “normal” means. Treat that baseline as a security control. Make legitimate paths visible, give verification social permission, and ensure no unexpected message can define company procedure by itself.
Found a factual error or a source that has changed?
Send a correction →
