Topic starter
25/10/2026 11:06 am
TL;DR: Open enrollment creates a predictable phishing window, Doppel says, as employees expect urgent benefits emails, portal logins, and helpdesk contact. Benefits workflows need a published verification path so staff know the one legitimate route and attackers cannot reuse the process as the lure.
Editorial analysis by NHI Mgmt Group, based on content published by Doppel: “The Open Enrollment Phishing Season Nobody's Training For”.
Key questions
Q: Why do benefits and HR workflows create such strong phishing opportunities?
A: They combine a real deadline, expected login activity, sensitive personal data, and multiple vendors with similar-looking messages.
Q: What are the signs that an open enrollment phishing attempt is moving beyond email?
A: Watch for the same issue reappearing in chat or voice after the first email, especially when the second contact adds pressure to act before a deadline.
Q: What should organisations do first to reduce open enrollment phishing risk?
A: Start by mapping the full enrollment journey, including every approved sender, portal, helpdesk number, and vendor touchpoint.
Practitioner guidance
- Map enrollment as a high-risk identity workflow Document the exact systems, sender domains, approved vendors, support numbers, and employee actions involved in open enrollment so teams know what should exist.
- Publish one canonical benefits hub Give employees a bookmarked internal page with the real portal, deadlines, approved contacts, and a short list of actions HR will never request.
- Train the helpdesk on benefits impersonation Teach front-line staff how to validate enrollment-related requests, escalate suspicious contacts, and avoid asking for credentials or one-time codes.
Bottom line: Open enrollment creates a predictable trust window where attackers can imitate legitimate HR activity and turn routine employee actions into phishing opportunities.
Glossary terms: Open Enrollment Phishing, Channel Chaining, Activation Trust Gap, Support Workflow Abuse
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
27/10/2026 7:17 pm
Open enrollment phishing is a calendar-driven identity attack, not a generic awareness problem. The article shows that attackers do not need to manufacture urgency when the business process already does it for them. That changes the governance question from “can users spot phishing?” to “has the organisation pre-validated the only legitimate path through a high-pressure identity workflow?” Practitioners should treat enrollment as a controlled identity event, not a communications season.
A few things that frame the scale:
- The IBM/Ponemon 2025 Cost of a Data Breach Report found that phishing-initiated breaches cost an average of $4.8M each.
A question worth separating out:
Q: How should HR and security share responsibility for benefits phishing prevention?
A: HR owns the process design, approved messaging, and employee guidance, while security owns verification, reporting, and response when the workflow is abused. The two teams need a single playbook because the attack crosses both domains. If each team assumes the other is handling it, the trust gap stays open.
👉 Read our full editorial: Open enrollment phishing exploits the deadline employees already trust
This post was modified 7 days ago by NHI Mgmt Group