‘Please fill in this confidential form and email it to me’
It’s not uncommon for IT, HR, finance or well-meaning admin support staff to ask you to fill in a form with sensitive information and just “email it back”. Even doctors and lawyers have been known to mishandle documents with signatures, tax file numbers or other identifying information such as birthdays. Don’t feel under pressure to do it. The fact is, such information is invaluable to hackers and identity thieves. Should your workplace email suffer a data breach, bad actors may be able to retrieve these scanned forms from inboxes they’ve invaded.

Most organisations have secure ways of transferring files, varying from a secure cloud storage solution to secure file sharing sites. Use them, and never your personal email or cloud solutions. If your organisation doesn’t have a secure way to save the files you can use one and send your colleague the link in a work email. Alternatively, you can send an encrypted PDF in an email, which means much tighter control of who can access the file. Sometimes the safest solutions are the simplest.

Go old-school: walk the documents over to the person instead of scanning and emailing them. If you’re asked to send personal information in an insecure way, hide your Pikachu face. Instead, say: “We’re supposed to be transferring files this way. If you want, I can show you how for next time?” Offering a solution, rather than shaming, is much more likely to lead to change.

Can you pass on my resume?
Job-hunters may try to get their foot in the door by leveraging a friend or ex-colleague. Many of us would be keen to help a friend by passing on their CV to the boss. Unfortunately, malicious actors of all kinds also know this. As outlined in this article, fake CVs can be sent by email with a Microsoft Excel attachment. When opened, the attached file can launch malware that: