# HR benefits and open enrollment phishing: how to protect employees

URL: https://iblockspam.com/blog/hr-benefits-open-enrollment-phishing
Last updated: 2026-10-12
Published: 2026-10-12
Topic: Phishing & threats
Author: iBlockSpam Team

> Why open enrollment season brings fake HR and benefits emails, what attackers steal, how to spot them, and an HR checklist to run before enrollment opens.

## Short answer

Open enrollment phishing is an email posing as HR or a benefits provider that urges employees to review benefits, confirm a salary change or avoid losing coverage, then sends them to a fake sign-in page. Attackers then change pay details or steal personal data. Open the benefits portal from a saved bookmark, never from the email.

"Action required: your 2027 benefits elections are incomplete. Employees who do not confirm their selections by Friday will be enrolled in the default plan." Every fall, real emails like this go out from HR teams and benefits platforms, and phishing crews copy them almost word for word. This guide explains why benefits season is such an effective cover for phishing, what the attackers do with a stolen HR login, and the checklist HR and IT should run before enrollment opens.

## What is HR benefits and open enrollment phishing?

HR benefits phishing is an email that impersonates your HR department, payroll team or benefits provider to steal an employee's login, personal data or pay. Open enrollment phishing is the seasonal version, timed for the weeks when employees are told to review health, retirement and other benefits.

Common lures include:

- Open enrollment deadlines and "incomplete elections"
- "You missed open enrollment" or "your coverage will be cancelled"
- Compensation updates, salary reviews and bonus letters
- New handbooks or policies to acknowledge
- Benefits surveys and wellness program sign-ups

Microsoft's October 2025 [payroll pirate report](https://www.microsoft.com/en-us/security/blog/2025/10/09/investigating-targeted-payroll-pirate-attacks-affecting-us-universities/) shows the pattern in the wild. A group it tracks as Storm-2657 used several themes. The most recent impersonated a university, with subject lines that usually named the university or its president, such as "[UNIVERSITY NAME] 2025 Compensation and Benefits Update."

This guide covers the benefits-season lure and how to prepare for it. For the pay-redirection end of the attack, see our guide to [payroll diversion scams](https://iblockspam.com/blog/payroll-diversion-scam-emails). For fake recruiters writing to job seekers, see [fake job offer emails](https://iblockspam.com/blog/fake-job-offer-recruitment-scam-emails).

## Why does open enrollment make phishing easier?

Open enrollment makes phishing easier because real benefits emails look like phishing, and employees have been told to act on them.

| What employees are told to expect | Why it helps attackers |
|---|---|
| An email with a deadline | Urgency is already normal |
| A link to sign in | Clicking a sign-in link feels routine |
| A sender they don't know well, such as an outside benefits platform | An unfamiliar sender doesn't raise alarm |
| Questions about dependents, beneficiaries and bank accounts | Requests for personal data seem expected |
| Single sign-on from their work account | One stolen login can open HR, payroll and email |

The prize is large. An HR platform typically holds Social Security numbers, home addresses, dependents' details and direct deposit accounts. If it uses single sign-on, a phished work password can open it too.

### An example of an open enrollment phishing email

This is an illustrative example, not a real message.

```
From: Benefits Team <benefits@yourcompany-hr.com>
Subject: ACTION REQUIRED: 2027 Open Enrollment closes Friday

Hi Jordan,

Our records show you have not confirmed your 2027 medical,
dental and 401(k) elections. Employees who miss the deadline
will lose dependent coverage for the plan year.

Review my benefits: https://yourcompany-benefits.example/login

Human Resources
```

Look at the sender domain (a lookalike of your real one), the threat to coverage, and a sign-in link that goes somewhere other than your real portal. Our guide to [lookalike domain phishing](https://iblockspam.com/blog/lookalike-domain-phishing) explains how attackers register names like these.

## What happens after an employee enters their password?

After an employee enters a password on a fake benefits page, the attacker signs in as them and works quietly to profit before anyone notices. Microsoft's account of Storm-2657 describes the steps:

1. **Steal the login and MFA code.** Some emails used adversary-in-the-middle (AiTM) phishing links that capture MFA codes as well as passwords. AiTM means the fake page relays your sign-in to the real one in real time. See [adversary-in-the-middle phishing](https://iblockspam.com/blog/adversary-in-the-middle-phishing-mfa-bypass).
2. **Get into the HR system.** The attacker signed in to the HR platform through single sign-on.
3. **Lock in access.** They enrolled their own phone numbers as MFA devices.
4. **Change the bank account.** They changed the employee's payroll bank account information.
5. **Hide the evidence.** They created inbox rules to delete "incoming warning notification emails from Workday," and in some cases may have named those rules with only special characters. See [malicious inbox rules](https://iblockspam.com/blog/malicious-inbox-rules-auto-forwarding).

Microsoft stressed that "These attacks don't represent any vulnerability in the Workday platform or products." Any HR or payroll service that stores bank details is exposed the same way. The FBI described the same playbook years earlier: its [September 2018 PSA](https://www.ic3.gov/PSA/2018/PSA180918) warned of criminals phishing employees' credentials, changing payroll bank details and adding rules so employees wouldn't see the alerts.

Other outcomes include identity theft from the personal data in the portal, and a compromised mailbox used to send the next round of phishing to colleagues.

## How can employees tell a real benefits email from a fake one?

A real benefits email matches what HR announced in advance and still works if you ignore its link. A fake one depends on its link.

| Check | Real benefits email | Phishing email |
|---|---|---|
| Sender | The address HR told you to expect | A lookalike domain or free webmail |
| Dates | Match the announced enrollment window | A sudden or shortened deadline |
| Tone | Reminder | Threat: lost coverage, cancelled pay, disciplinary action |
| Link | Optional; the portal works from your bookmark | The only way in |
| Sign-in page | Your normal company sign-in | A page reached from the email, sometimes via a shared document |
| Requests | Make your elections in the portal | Send your SSN, bank details or password by email or form |

The Department of Labor's [Online Security Tips](https://www.dol.gov/agencies/ebsa/key-topics/retirement-benefits/cybersecurity/online-security-tips) for retirement plan participants list the same warning signs, including "Mismatched links," "Strange or mismatched sender addresses," and messages that "express great urgency, or are aggressive and scary." It adds that legitimate providers should never send emails or texts asking for your password.

## What should HR and IT do before open enrollment?

HR and IT should agree how enrollment will be communicated, tell employees in advance, and harden the accounts that open the HR system. Run this checklist a few weeks before enrollment opens.

1. **Publish the plan.** Announce the dates, the portal name and the exact sender addresses employees will see, on the intranet and in a team meeting, not only by email.
2. **Make the portal reachable without email.** Provide an intranet tile or bookmark, and write emails that say "open the benefits portal as usual," not "click here to sign in."
3. **Authenticate outside senders.** If a benefits platform sends as your domain, make sure it passes SPF, DKIM and DMARC. See [authenticating third-party senders](https://iblockspam.com/blog/authenticate-third-party-senders-spf-dkim-dmarc).
4. **Enforce DMARC on your domain.** CISA's [phishing guidance](https://www.cisa.gov/sites/default/files/2023-10/Phishing%20Guidance%20-%20Stopping%20the%20Attack%20Cycle%20at%20Phase%20One_508c.pdf) says to "Ensure DMARC is set to 'reject' for sent emails," so exact-domain spoofs of HR are blocked. Check yours with the [DMARC Checker](https://iblockspam.com/tools/dmarc-checker).
5. **Use phishing-resistant MFA** on single sign-on and the HR platform. CISA recommends "FIDO or PKI-based MFA," and Microsoft recommends "passwordless, phishing-resistant MFA methods such as FIDO2 security keys."
6. **Alert on bank detail changes.** Send a notice to the employee's existing contact details whenever direct deposit changes, and consider a short hold on new accounts.
7. **Watch for new MFA devices and inbox rules.** Both were part of the Storm-2657 playbook.
8. **Tag external email and watch for lookalikes.** An "External" tag on a message signed "Human Resources" is a strong clue.
9. **Brief the help desk.** Tell them which benefits questions are expected, and how to route reports of suspicious HR emails.
10. **Remind employees how to report.** One click to report, with no blame for reporting a real email by mistake.

## What should an employee do after clicking a fake benefits email?

An employee who entered a password on a fake benefits page should report it immediately, because speed decides whether the attacker gets paid.

1. **Tell IT or security now**, even if nothing seemed to happen.
2. **IT resets the password and revokes sessions** from a clean device, and checks for MFA devices the employee didn't add. Microsoft's guidance also says to revert unauthorized payroll changes and remove malicious inbox rules.
3. **Check the HR portal** for changes to direct deposit, tax withholding, address and beneficiaries.
4. **Tell payroll** before the next pay run.
5. **Watch for identity misuse** if the portal holds your Social Security number. Report scams to the FBI at [ic3.gov](https://www.ic3.gov).

Our [what to do after clicking a phishing link](https://iblockspam.com/blog/what-to-do-after-clicking-phishing-link) guide has the full personal checklist.

## What about Medicare and retirement account scams in the same season?

Medicare and retirement scams overlap with workplace open enrollment, so older employees and retirees may get several kinds of fake benefits email at once. [Medicare's Open Enrollment](https://www.medicare.gov/health-drug-plans/open-enrollment) runs from October 15 to December 7, and Medicare says changes made then take effect on January 1 of the next year. At the time of writing (October 2026), that means the current window sets coverage for 2027.

[Medicare.gov](https://www.medicare.gov/basics/get-started-with-medicare/using-medicare/your-medicare-card) says Medicare "will never call you uninvited and ask you to give us personal or private information," and advises: "Don't share your Medicare Number or other personal information with anyone who contacts you by phone, email, or in person, unless you contacted them first and gave them permission to contact you."

For 401(k) and other retirement accounts, the Department of Labor advises participants to register and monitor their online account, use strong and unique passwords, turn on multi-factor authentication and keep contact information current. Including those tips in enrollment materials costs nothing.

## Next steps

1. Put the HR checklist above on the agenda for your next HR and IT meeting, before enrollment opens.
2. Send employees one short message with the enrollment dates, the real sender address and the portal bookmark.
3. Check your domain's DMARC policy and enforce it if you haven't. Our [DMARC from none to reject guide](https://iblockspam.com/blog/dmarc-none-to-reject-small-business) shows the safe path.
4. Add a filter layer for the season. iBlockSpam filters inbound mail for the whole domain, and its [Lookalike Domain Watch](https://iblockspam.com/features/lookalike-domain-watch) alerts you when look-alike domain names are registered or get a mail server.

Browse our other [phishing and threat guides](https://iblockspam.com/blog/topic/threats).

## Frequently asked questions

### Why do phishing emails spike during benefits open enrollment?

Because employees expect benefits emails at that time, often from an outside benefits platform they rarely use, with links, deadlines and sign-in prompts. An attacker who copies that format blends in. A stolen HR or single sign-on login can expose bank details, Social Security numbers and dependents' information, which makes it worth the effort.

### How can employees tell a real open enrollment email from a fake one?

Compare it with what HR announced in advance: the sender address, the portal name and the dates. A real email matches all three and works just as well if you ignore its link and open the portal from your bookmark. A fake one usually adds urgency, such as lost coverage, and wants you to sign in through its link.

### What can an attacker do with a stolen HR portal login?

Microsoft described attackers who signed in to an HR platform through single sign-on, added their own phone numbers as MFA devices, changed employees' payroll bank account details and created inbox rules to delete the HR system's warning emails. Personal data in the portal, such as Social Security numbers and dependents, can also be stolen.

### Should HR stop putting links in benefits emails?

Not necessarily, but make links optional. Tell employees where the portal lives, such as an intranet tile or a bookmark, and write emails that say open the benefits portal as usual rather than click here to sign in. Then a fake link stands out, and training can teach one simple rule.

### Do Medicare Open Enrollment scams also arrive by email?

They can. Medicare's Open Enrollment runs from October 15 to December 7, and Medicare.gov warns not to share your Medicare Number or other personal information with anyone who contacts you by phone, email or in person, unless you contacted them first. Older employees and retirees may see both kinds of scam at once.

## Sources

- [Microsoft Threat Intelligence: Investigating targeted 'payroll pirate' attacks affecting US universities (October 2025)](https://www.microsoft.com/en-us/security/blog/2025/10/09/investigating-targeted-payroll-pirate-attacks-affecting-us-universities/)
- [FBI IC3 PSA: Cybercriminals Utilize Social Engineering Techniques To Obtain Employee Credentials To Conduct Payroll Diversion (September 2018)](https://www.ic3.gov/PSA/2018/PSA180918)
- [US Department of Labor, EBSA: Online Security Tips](https://www.dol.gov/agencies/ebsa/key-topics/retirement-benefits/cybersecurity/online-security-tips)
- [CISA, NSA, FBI, MS-ISAC: Phishing Guidance: Stopping the Attack Cycle at Phase One](https://www.cisa.gov/sites/default/files/2023-10/Phishing%20Guidance%20-%20Stopping%20the%20Attack%20Cycle%20at%20Phase%20One_508c.pdf)
- [Medicare.gov: Open Enrollment](https://www.medicare.gov/health-drug-plans/open-enrollment)
- [Medicare.gov: Your Medicare card](https://www.medicare.gov/basics/get-started-with-medicare/using-medicare/your-medicare-card)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.
- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.

---

Source: iBlockSpam, https://iblockspam.com/blog/hr-benefits-open-enrollment-phishing (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt