Open enrollment phishing: what should HR and IAM teams rehearse?

TL;DR: Open enrollment creates a seasonal phishing window because employees expect urgent benefits emails, portal logins, and helpdesk contact, according to Doppel, and attackers can chain email, chat, and voice to make a fake request feel routine. The safer control is a rehearsed verification path, not generic phishing awareness.

Editorial analysis by NHI Mgmt Group, based on content published by Doppel: “The Open Enrollment Phishing Season Nobody's Training For”.

Key questions

Q: What should organisations do first to reduce open enrollment phishing risk?

A: Start by mapping the full enrollment journey, including every approved sender, portal, helpdesk number, and vendor touchpoint.

Q: Why do benefits and HR workflows create such strong phishing opportunities?

A: They combine a real deadline, expected login activity, sensitive personal data, and multiple vendors with similar-looking messages.

Q: What are the signs that an open enrollment phishing attempt is moving beyond email?

A: Watch for the same issue reappearing in chat or voice after the first email, especially when the second contact adds pressure to act before a deadline.

Practitioner guidance

• Map enrollment as a high-risk identity workflow Document the exact systems, sender domains, approved vendors, support numbers, and employee actions involved in open enrollment so teams know what should exist.
• Publish one canonical benefits hub Give employees a bookmarked internal page with the real portal, deadlines, approved contacts, and a short list of actions HR will never request.
• Train the helpdesk on benefits impersonation Teach front-line staff how to validate enrollment-related requests, escalate suspicious contacts, and avoid asking for credentials or one-time codes.

Bottom line: Open enrollment creates a predictable trust window where attackers can imitate legitimate HR activity and turn routine employee actions into phishing opportunities.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →