Recently, GoDaddy executed a self-phishing test against its own employees. The message that employees received said told them that they could claim their holiday bonus by submitting their contact details on some website:

From: [email protected]
Date: Mon 12/14/2020
Subject: 2020 Holiday Party

Happy Holiday GoDaddy!

2020 has been a record year for GoDaddy, thanks to you!

Though we cannot celebrate during our annual Holiday Party, we want to show our appreciation and share a $650 one-time Holiday bonus! To ensure that you receive your one-time bonus in time for the Holidays, please select your location and fill in the details by Friday, December 18th.

(Link for US)

(Link for EMEA)

Any submittals after the cutoff will not be accepted and you will not receive the one-time bonus of $650 (free money, claim it now!)

We look forward to celebrating with you again, in person next year!

The company is making the ~500 employees who followed the link retake their Security Awareness Social Engineering training, and presumably not paying out.

So, does that constitute a breach of contract? There was an offer, acceptance, and consideration (the victim submitted personal information). The only thing that makes this exchange not routine is that the transaction happened on a medium that the employer deemed inappropriate. But that's an arbitrary designation on the part of the employer that can't invalidate the contract, right?

The difference between usual phishing and this situation is that you usually can't pin down the identity of the scammers, and therefore can't enforce compliance. But the company, in their follow-up e-mail, has pretty much admitted to having authored the offer and confirmed that they received the payment request from victims:

“You’re getting this email because you failed our recent phishing test,” the company’s chief security officer Demetrius Comes wrote. “You will need to retake the Security Awareness Social Engineering training.”

Sure, the victim employees will now have to retake a training course, but they should be eligible for the $650 bonus now, and could sue for breach of contract to claim it, right? Is there any flaw in this reasoning?

Recently, GoDaddy executed a self-phishing test against its own employees. The message that employees received said that they could claim their holiday bonus by submitting their contact details on some website:

From: [email protected]
Date: Mon 12/14/2020
Subject: 2020 Holiday Party

Happy Holiday GoDaddy!

2020 has been a record year for GoDaddy, thanks to you!

Though we cannot celebrate during our annual Holiday Party, we want to show our appreciation and share a $650 one-time Holiday bonus! To ensure that you receive your one-time bonus in time for the Holidays, please select your location and fill in the details by Friday, December 18th.

(Link for US)

(Link for EMEA)

Any submittals after the cutoff will not be accepted and you will not receive the one-time bonus of $650 (free money, claim it now!)

We look forward to celebrating with you again, in person next year!

The company is making the ~500 employees who followed the link retake their Security Awareness Social Engineering training, and presumably not paying out.

So, does that constitute a breach of contract? There was an offer, acceptance, and consideration (the victim submitted personal information). The only thing that makes this exchange not routine is that the transaction happened on a medium that the employer deemed inappropriate. But that's an arbitrary designation on the part of the employer that can't invalidate the contract, right?

The difference between usual phishing and this situation is that you usually can't pin down the identity of the scammers, and therefore can't enforce compliance. But the company, in their follow-up e-mail, has pretty much admitted to having authored the offer and confirmed that they received the payment request from victims:

“You’re getting this email because you failed our recent phishing test,” the company’s chief security officer Demetrius Comes wrote. “You will need to retake the Security Awareness Social Engineering training.”

Sure, the victim employees will now have to retake a training course, but they should be eligible for the $650 bonus now, and could sue for breach of contract to claim it, right? Is there any flaw in this reasoning?

Recently, GoDaddy executed a self-phishing test against its own employees. The message that employees received said told them that they could claim their holiday bonus by submitting their contact details on some website:

From: [email protected]
Date: Mon 12/14/2020
Subject: 2020 Holiday Party

Happy Holiday GoDaddy!

2020 has been a record year for GoDaddy, thanks to you!

Though we cannot celebrate during our annual Holiday Party, we want to show our appreciation and share a $650 one-time Holiday bonus! To ensure that you receive your one-time bonus in time for the Holidays, please select your location and fill in the details by Friday, December 18th.

(Link for US)

(Link for EMEA)

Any submittals after the cutoff will not be accepted and you will not receive the one-time bonus of $650 (free money, claim it now!)

We look forward to celebrating with you again, in person next year!

The company is making the ~500 employees who followed the link retake their Security Awareness Social Engineering training, and presumably not paying out.

So, does that constitute a breach of contract? There was an offer, acceptance, and consideration (the victim submitted personal information). The only thing that makes this exchange not routine is that the transaction happened on a medium that the employer deemed inappropriate. But that's an arbitrary designation on the part of the employer, right? And the company has pretty much admitted to having authored the offer in their follow-up e-mail:

“You’re getting this email because you failed our recent phishing test,” the company’s chief security officer Demetrius Comes wrote. “You will need to retake the Security Awareness Social Engineering training.”

Sure, the victim employees will now have to retake a training course, but they should be eligible for the $650 bonus now, and could sue for breach of contract to claim it, right? Is there any flaw in this reasoning?

Recently, GoDaddy executed a self-phishing test against its own employees. The message that employees received said told them that they could claim their holiday bonus by submitting their contact details on some website:

From: [email protected]
Date: Mon 12/14/2020
Subject: 2020 Holiday Party

Happy Holiday GoDaddy!

2020 has been a record year for GoDaddy, thanks to you!

Though we cannot celebrate during our annual Holiday Party, we want to show our appreciation and share a $650 one-time Holiday bonus! To ensure that you receive your one-time bonus in time for the Holidays, please select your location and fill in the details by Friday, December 18th.

(Link for US)

(Link for EMEA)

Any submittals after the cutoff will not be accepted and you will not receive the one-time bonus of $650 (free money, claim it now!)

We look forward to celebrating with you again, in person next year!

The company is making the ~500 employees who followed the link retake their Security Awareness Social Engineering training, and presumably not paying out.

So, does that constitute a breach of contract? There was an offer, acceptance, and consideration (the victim submitted personal information). The only thing that makes this exchange not routine is that the transaction happened on a medium that the employer deemed inappropriate. But that's an arbitrary designation on the part of the employer that can't invalidate the contract, right?

The difference between usual phishing and this situation is that you usually can't pin down the identity of the scammers, and therefore can't enforce compliance. But the company, in their follow-up e-mail, has pretty much admitted to having authored the offer and confirmed that they received the payment request from victims:

“You’re getting this email because you failed our recent phishing test,” the company’s chief security officer Demetrius Comes wrote. “You will need to retake the Security Awareness Social Engineering training.”

Sure, the victim employees will now have to retake a training course, but they should be eligible for the $650 bonus now, and could sue for breach of contract to claim it, right? Is there any flaw in this reasoning?