I'm the CEO of a 35-person company. Today, a new-ish employee on our team got a text from a random phone number, claiming to be me. She flagged it in Slack as spam, but it made me wonder...
Naive question: How did these spammers get my new employee's phone number? To send the text, they must have known that she started at my company, reporting to me, and gotten her phone number. I understand that it's easy to get emails of new employees since we each have a similar email address pattern, but phone number seems more difficult. If I search her phone number online, it's not listed anywhere publically. Is there any way to protect our employees from phishing attempts via text?
So, may be she told a few people her new work number. They saved it to their devices, which had an malicious app running.
Not necessarily you're compromised. May be her contact is listed in your webpage? That happened to me too, where the employer decided to put clear text href email address publicly on the website. The machinery acted quickly. By finding information like "sales" or "customer service", connections can be made. So Phishing is more effective.
But still. For me, it would be an alarm sign to trigger an investigation. If there is no public listing of contact information, then its likely in the inner rings. Because.. knowing that you're CEO and writing in your name to a new mobile number, it looks like spearphishing.
The only way to protect is to train train train. Why did she mark it as spam in slack? Because she used her suspectsissity and her feelings. Let her tell the others how she came to the conclusion it's spam. There won't be much she will tell (I think) but it will raise sensitivity with others, because they'll remember the story..