Imagine that you receive an email from one of your third-party service providers—someone you know well—exchanging pleasantries and asking for the payment of last month’s invoice via the company’s new payment processing system. The person has provided a link to the new system so you can set up your new account and remit payment.
Most of us know it’s not wise to click on links in suspicious emails. We know not to disclose private information or respond to requests to wire money, even when they appear to be sent from within our own organizations. But what about when the emails aren’t suspicious? When they are so well-engineered that they use real people and authentic information, raising no red flags at all, even to the most discerning recipient?
