The scam of the good employee begins with a problem that seems to require an immediate solution. Someone calls the business, claims to know the person in charge, and demands a payment to avoid a penalty, a service cut, or an outstanding debt.
The Guardia Civil has warned of this modality, which relies on the worker’s willingness to resolve an incident. The person he or she speaks with may present himself or herself as a supplier, manager, or representative of an agency, rather than pretending directly to be the boss.
The decisive request comes afterward: transferring money or providing a means of payment without checking via another channel whether the obligation exists.
How they make a false order seem real
The use of names, positions, or details of the establishment helps to give credibility to the call. However, knowing those details does not prove that the person you speak with is authorized to order an operation.
In the CEO fraud, a related modality, the criminal impersonates an executive in order to obtain payments. INCIBE identifies as warning signs the urgency, confidentiality, and unexpected changes in bank data.
The aim is to prevent the employee from interrupting the communication and consulting. Pressure replaces the usual procedure: the less time there is to think, the harder it is to detect that the request does not fit.
Falling for the scam does not justify any dismissal
That the company loses money does not, by itself, resolve the employee’s employment liability. A disciplinary dismissal requires a serious and culpable breach, in accordance with Article 54 of the Workers’ Statute.
That is why different situations must be differentiated. It is not the same as acting within the functions assigned and following a procedure that apparently is valid, while disregarding explicit security instructions or carrying out operations for which one does not have authorization.
The assessment will depend on the verified facts. Presenting every victim as responsible for the scam removes that distinction and can pass on to the worker a consequence that does not automatically follow from the deception.
What the worker should do in the case of an urgent payment
Verification must be carried out through an independent channel. If the order comes by phone, the call can be ended and the person in charge can be contacted using the number the company usually uses.
Reply to the same suspicious message or call the phone number the supposed manager provides does not offer that verification. The check has to be carried out outside the circuit that controls who requests the money.
INCIBE recommends establishing a dual control for certain transfers and specific procedures for new bank accounts. These measures allow the decision not to depend on a single employee under pressure.
What to keep if the payment has already been made
The initial response must include notifying the bank and the company, as well as keeping messages, receipts and transaction data. INCIBE also advises filing a report with the Police or the Civil Guard and provides guidance through 017.
If later a disciplinary procedure is opened, those documents help to reconstruct what order was received, what checks were carried out, and what instructions were in effect. The worker must also keep communications with their superiors and the protocols they would have been provided with before the incident.