Recently, the Information Security Department carried out another phishing simulation across the BALFIN Group. This time, the email was disguised as a message from Human Resources.
It seemed to come from a familiar source, using an address like balfin.live. But here’s the catch: there is no such domain. Our official addresses are always @balfin.al.
This wasn’t a real attack, but in a real scenario the consequences could have been serious.
This Is Important
Phishing emails are one of the easiest ways for attackers to break into internal systems. All it takes is one careless click. These emails often copy the style, tone, and urgency of real company messages, making them hard to spot if we’re not paying close attention.
The recent test showed that several colleagues clicked the fake link and even entered their credentials,proof that anyone can fall for a convincing trap when distracted, busy, or unaware.
What You Should Do
- Check the sender’s email address carefully – don’t rely just on the name.
- Watch for fake domains – in this case, @balfin. live instead of the real @balfin.al.
- Pay attention to system warnings – Outlook flagged this email as “originating from outside the organization.” Internal HR emails will never trigger this banner.
- Report suspicious messages immediately to the Information Security team.
Final Reminder
This was a safe drill, but next time it could be the real thing. Stay alert, question the unexpected, and always double-check before you click.
Cybersecurity starts with each of us.
