What should organisations do first to reduce open enrollment phishing risk?

Why the first move is journey mapping, not awareness training

Open enrollment phishing succeeds when the attacker can imitate a real business process well enough that employees follow the wrong route on purpose. The first task is to map the legitimate enrollment journey end to end, because people can only spot a fake when they know the one approved path it is trying to copy.

A usable map should name each approved sender, portal, phone number, HR or benefits handoff, and vendor touchpoint. That gives security, HR, and service desk teams a shared reference for what should exist, what should never change mid-cycle, and which messages or requests deserve immediate challenge.

Once that path is explicit, defenders can turn it into a simple decision aid for users and service staff. The point is not to make employees into fraud analysts, but to remove ambiguity so a convincing email, text, or callback lure does not become the default way to resolve enrollment friction.

What the published safe path should contain

The safe path should be short enough to remember and detailed enough to remove guesswork. At minimum, it should identify the official entry point for enrollment, the exact web address or portal name, the approved helpdesk contact route, and the expected identity of any vendor or broker that may legitimately contact employees during the window.

The route should also define what legitimate communication looks like, including whether the organisation ever asks for action by email, whether links are ever sent in messages, and whether the enrollee is supposed to reauthenticate through the portal rather than through a message thread. That helps eliminate the common trick of blending a real deadline with an invented handoff.

Where the process spans multiple teams, the map should show who owns each step and what must be verified before the next step is accepted. In practice, that means the helpdesk, HR, benefits administrator, and security team all need the same script for handling enrollment questions so one weak handoff does not become the phishing entry point.

Why attackers target enrollment workflows

Open enrollment creates a time-bound window when urgency, benefit changes, and user confusion all rise at once. That combination is ideal for phishing because the attacker does not need a novel exploit, only a believable instruction that fits the expected business rhythm and pressures the user to act quickly.

This is especially effective when workers expect reminders, attachments, forms, or vendor notices. A criminal can exploit that expectation by imitating an approved route, then redirecting the user to a fake portal, a credential capture page, or a callback number that bypasses normal verification.

When the journey is not mapped, defenders tend to over-rely on broad warning messages that say to “be careful.” That rarely stops a well-timed lure, because the user still lacks a concrete test for deciding whether the request is genuine. A published safe path narrows that uncertainty before the campaign starts.

Risk and Threat Considerations

Open enrollment phishing is dangerous because it abuses trust in a real business process, not just trust in a brand name. If the legitimate process is unclear, an attacker can exploit that ambiguity to collect credentials, redirect payments, or steer employees into a fraudulent portal that looks operationally normal.

Failure mechanism: Employees cannot distinguish the approved enrollment route from an imitation, so they follow a convincing but illegitimate sender, link, portal, or callback path and disclose sensitive access or benefit information.

Impact: The organisation can see account compromise, fraudulent enrollment changes, exposure of personal or payroll data, helpdesk fraud, and wider trust loss in the benefits process, especially during peak enrollment volume.

Practitioner Guidance

What to prioritise: Build the authoritative enrollment journey first, then test it against real employee questions and service desk scripts. If staff cannot answer “what is the one legitimate route?” in a few seconds, the control is not ready for peak enrollment traffic.

What to verify: Confirm that the published path covers every approved touchpoint and that each one is owned, monitored, and easy to reach from the normal employee entry point. If there are multiple legitimate routes, make the branching conditions explicit so users do not improvise.

Common mistake: Treating the problem as a training issue alone. Awareness helps, but it does not remove attacker leverage when the business process itself is vague, inconsistent, or communicated through too many channels.

Practitioner takeaway: The best first control is to make the genuine enrollment path easy to recognise and hard to improvise, because phishing resistance starts with process clarity, not with suspicion alone.

Related resources from NHI Mgmt Group

• Guide: Phishing Guide
• When should organisations treat an NHI as a high-priority risk?
• How can organisations reduce the blast radius of compromised agent identities?
• How should teams reduce the risk from overprivileged NHIs?
• Should organisations prioritise external exposure or internal credential governance first?