Recruitment Email on a Shared Branch Computer
At a branch, a clerk receives an email with the subject 'Urgent: Verify Your Recruitment Application within 24 Hours'. The sender display name is 'Central Recruitment Helpdesk', but the address is [email protected]. The message says the application will be rejected unless the clerk clicks a shortened link and enters registration number, date of birth, password and the OTP sent to the registered mobile. It also asks the clerk to open an attached file named 'candidate_list.pdf.exe' to confirm the application. The clerk has already logged in to the recruitment portal on a shared branch computer and allowed the browser to save the password. A colleague says the email 'looks official' because it uses a logo and the correct exam name. You are asked to assess the situation and advise the clerk.
1. Identify the red flags in the email and explain what each suggests.
Read the worked answer
- Sender domain mismatch: the display name says 'Central Recruitment Helpdesk', but the domain is recruitment-verify.co, not an official domain. Display names are easy to spoof.
- Artificial urgency: a 24-hour deadline pressures the recipient to act before verifying.
- Request for password and OTP: a legitimate helpdesk does not need a candidate's password or OTP. The OTP is the second factor and should never be shared.
- Shortened link: the real destination is hidden; it may lead to a fake login page.
- Double extension
candidate_list.pdf.exe: this is an executable program, not a PDF. Opening it can install malware. - Logo and exam name: these are copied easily and prove nothing.
- Shared computer with saved password: this increases the chance that another person can reuse the credentials.
2. State the immediate steps the clerk and branch should take, in order.
Read the worked answer
- Do not click the link, open the attachment, or enter any password or OTP.
- Report the email to branch IT/security and preserve it as evidence, including the full sender address and link destination.
- From a trusted device, change the recruitment-portal password and any other account where the same password was reused; revoke the saved password in the browser.
- Enable two-factor authentication where available and check the account's recent login activity.
- Have IT scan the shared computer for malware before it is used for login work again.
- Inform colleagues who use the same computer, and if credentials were already entered, contact the portal's official helpline and monitor for fraud.
3. Explain why 'it looked official' is not a valid defence, and name the broader security concept involved.
Read the worked answer
'It looked official' is not a defence because attackers routinely copy logos, exam names, signatures and display names. The security decision must rest on verifiable facts: the sender's actual domain, the real URL behind a shortened link, whether the request is normal for that service, and whether the channel is known. Appearance is controlled by the attacker; the domain and the OTP request are not. The broader concept is phishing, a form of social engineering. The .exe attachment adds a malware-delivery risk, so the incident is both credential theft and possible endpoint compromise.