Scammers always know about our new users

Hi richardlister13,

your problem of new employees receiving scam emails shortly after joining your system most likely comes from data breaches and leaks.

Scammers acquire email addresses and names through these breaches for malicious purposes. Here's a detailed breakdown of how this happens:

- Data Breaches and Leaks: Over the years, data breaches have exposed sensitive user information, including email addresses and names. This compromised data is often traded or sold on the dark web, making it accessible to scammers.

- Dark Web and Underground Markets: Scammers frequently procure these breached data sets from the dark web or underground markets, where they can easily access vast amounts of personal information.

- Automated Tools: Scammers employ automated tools and scripts to scour the internet for email addresses linked to specific domains, like your company's. Once they compile a list of valid email addresses, they pair them with publicly available names.

To try to minimize this issue, you can take the following measures:

1. Email Security: Enhance email security with robust spam filters, antivirus scans, and email authentication protocols like SPF, DKIM, and DMARC.

2. Data Leak Monitoring: Regularly monitor the internet and the dark web for any data leaks associated with your company's email addresses and personal information. (for example: Have I Been Pwned: Check if your email has been compromised in a data breach)

3. Multifactor Authentication (MFA): Enable 2FA for email accounts and other sensitive systems to bolster security.

4. Incident Response Plan: Develop a robust incident response plan to address potential data breaches promptly.

While it's challenging to completely prevent such incidents, these measures should significantly reduce the risk of new employees being targeted by scammers shortly after their email addresses are configured.