The new hire got a text from “the owner”
Days after starting in accounts payable, a new employee got a text on her personal phone from someone claiming to be the owner, asking for a quick favour. She didn’t act on it, and she reported it. The question that followed was whether the company had leaked her number.
Why new finance staff are targeted
Attackers watch for new hires in finance. A new employee doesn’t yet know how the owner writes, doesn’t know that the owner never texts about gift cards or urgent wires, and wants to be helpful. Job postings, a fresh professional profile and data brokers tell an attacker who just started and what their role is. A text impersonating the boss in the first week is a well-worn play.
Did it come from us?
The reasonable worry is that the number came from company systems, since a personal mobile number is often registered for sign-in verification. Rather than guess, we ran a read-only sweep of the identity and mail systems:
- Profile exposure: whether the number appears anywhere visible in the directory, the address book or user profile fields.
- Sign-in method history: when verification methods were registered, from where.
- Sign-ins and risk: foreign or unfamiliar locations, repeated failures, risk detections.
- Devices and app consents: unfamiliar devices joined to the account, third-party apps granted access.
- Mail: forwarding and inbox rules on her mailbox and the shared finance mailboxes, including hidden rules, and inbound mail with likely lure subjects.
The identity side came back clean: no exposure of the number in directory fields, one normal sign-in-method registration from the office, an ordinary onboarding audit trail. The far more likely sources were outside: a resume, a professional networking profile, a data broker, or onboarding paperwork that passed through more inboxes than it needed to.
The most expensive part of a phishing attempt is the one that works. The cheapest defence is a new hire who’s been told to expect it.
What the review turned up anyway
Checks like this rarely find only the thing you were looking for. This one found two loose ends: the new employee hadn’t been added to the group that requires the strongest sign-in method for finance staff, and the policy enforcing it was still in report-only mode two months after rollout. Both were small fixes — and exactly the kind of gap an attacker relies on.
What finance onboarding should include
- Day one, in person: the owner and controller will never ask for gift cards, wire changes or urgent payments by text. Anyone who does is not them.
- A known verification path: a phone number or channel to confirm any unusual request, and permission to use it without feeling awkward.
- Strong sign-in from the start: phishing-resistant verification for anyone who can move money, enforced, not in report-only mode.
- Payment changes by callback: vendor bank detail changes confirmed by calling a number already on file, never the one in the email.
- Minimal paperwork exposure: onboarding documents with personal data go to as few mailboxes as possible.
- Praise the report. This one was caught because the new employee reported it. Say so, publicly.
Why this is part of back-office work
Most payment fraud at small and mid-size companies doesn’t start with a hacked system. It starts with a convincing message to the person who can pay a bill. Keeping the ERP, the payment process and the identity system under one roof is how the controls actually line up: who can change vendor bank details, who approves a payment, and how both are protected.
Related: ACH addenda and vendor payments, and cash application without the spreadsheet.