As an employee, you are on the front line of cybersecurity. Cybercriminals use manipulation tactics such as instilling a sense of fear, urgency, or curiosity to persuade people to take action that compromises data security. This is called “Social Engineering,” and poses a large threat to company security.

You may receive simulated phishing emails from information security. These are a core component of our Information Security Training and Awareness program at RXO. Simulated phishing campaigns allow employees to practice identifying and reporting suspicious messages in a safe environment.

That does not mean every suspicious email you receive comes from our team, so it is important to exercise caution when interacting with all messages you receive.

• The sender address is external, and the external sender banner is present. Look for the note: [Caution: External Sender].
• The greeting is impersonal or non-existent, the email is written in an unusual tone, and there are spelling and grammatical errors.
• The link is disguised. If you hover over the hyperlink, the true destination is not a safe URL.
• There is no signature, or the signature lacks professionalism and legitimate contact information.

• The external sender banner is present.
• The message comes from a suspicious sender address
• There is no greeting.
• The body of the email has unusual typing errors.
• The message itself is vague and unsolicited.
• The URL leads to a suspicious address.
• There is no signature.
• The message uses bait located at the bottom of the email to trick the reader into believing it is secure.

This email uses curiosity and urgency as motivators to get the recipient to take action.