Your company is participating in a Cyber Security Education Program.


This PayPal Compromise Phishing Attack included the following social engineering techniques:


  1. Urgency to act - Update your login information immediately
  2. Name stuffing/overload: a fake email address is included in the Sender Name to make it appear as though the email was from PayPal.
  3. Subject to appear critical or official: New logon to your account
  4. Urgent email / consequence for no action (example: ... secure your account)
  5. Limited and simple content to minimize detection by email filters.


How to spot this was a phishing email:



  1. From email address domain not associated with PayPal: sender email domain is locked-outlook.com)
  2. The link provided references a domain not associated with official company (example: locked-outlook.com); official being something like "paypal.com"
  3. This email was/may have been filtered and in your junk mail folder.


“An employee is either an asset to your cyber security or a risk.”