Spoofed Human Resources caller-ID phishing of employee phones

To check this alert, SuperGrok Heavy 4.5 (an AI) read it in full 25 separate times, independently. Each read decided whether the message answers each of the six questions and gave a short reason. A final reviewer then weighed all 25 and wrote the plain-English verdict you see when you open a row. The score (for example 22/25) is how many reads agreed; the 25 individual reads are tucked underneath if you want to check them.

• Sourcepresent25/25

  Final assessment

  S 25/25 majority present. TIMELY WARNING BULLETIN, we are issuing this Timely Warning Notice, and FIU Security Office identify the sender.

  Who is sending the alert and who is responding. People act faster on a message from a clearly identifiable, credible sender, such as a named department, the police, or a branded alert system, than on an anonymous notice. A branded signature counts.

  See all 25 individual reads

  1. present: TIMELY WARNING BULLETIN is a branded Clery header that identifies the campus as sender.
  2. present: We have reports of FIU employees opens in the institutional first person of the issuer.
  3. present: We are issuing this Timely Warning Notice names the campus as originator.
  4. present: Contact the FIU Security Office at security@fiu.edu identifies a named campus security unit.
  5. present: The Jeanne Clery compliance sentence is written as we are issuing, a sender cue.
  6. present: Opening TIMELY WARNING BULLETIN January 20, 2023 is a campus warning product tag.
  7. present: FIU Security Office is the office named for victims to notify, branding a university source.
  8. present: Notify your supervisor and contact FIU Security Office still points to campus authorities as the voice.
  9. present: In compliance with Clery we are issuing this notice is the university speaking.
  10. present: The bulletin form itself, titled TIMELY WARNING BULLETIN, counts as source identification.
  11. present: First-person we in both the lead and the Clery close identifies who sent it.
  12. present: FIU is named throughout as the organization issuing the warning about its own HR spoof.
  13. present: A Timely Warning Notice issued under Clery is a named campus product, hence a source.
  14. present: Security@fiu.edu plus FIU Security Office name the campus security sender-contact.
  15. present: The header TIMELY WARNING BULLETIN plus we are issuing together identify the issuer.
  16. present: This is an FIU timely warning, not an unattributed flyer, because the Clery we is present.
  17. present: Kindly hang up is advice from the campus bulletin's we, the sending voice.
  18. present: The Federal Communications Commission is a referral, while FIU Security Office is the campus source named.
  19. present: Reports of FIU employees receiving calls are compiled in the we-have-reports campus voice.
  20. present: Issuing this Timely Warning Notice to report an incident identifies the warning's author as the institution.
  21. present: Branded timely-warning masthead is treated as source under the same rule as other FIU TWs.
  22. present: FIU will never initiate a call is the university stating policy in its own sending voice.
  23. present: The Security Office email is a named campus unit attached to the notice.
  24. present: Clery footer we are issuing plus the bulletin title name who sends.
  25. present: Campus origin is clear from TIMELY WARNING BULLETIN and the FIU Security Office contact.
• Hazardpresent25/25

  Final assessment

  H 25/25 majority present. Spoofed FIU caller ID impersonating Human Resources to steal codes and account access is a specific phishing threat.

  What the threat actually is. A complete warning names the specific danger, such as a shooter, a fire, a tornado, or a gas leak, rather than a vague emergency, because people decide what to do based on what they are facing.

  See all 25 individual reads

  1. present: Phone number spoofing that impersonates Human Resources is a specific phishing threat, not a generic incident.
  2. present: A caller falsifies caller ID to look like a legitimate FIU number, which names the method.
  3. present: The caller claims to be from Human Resources and asks for confidential information to access an FIU account.
  4. present: This is a type of phishing attack known as phone number spoofing, a specified hazard.
  5. present: Gaining personal and confidential information under a fake HR identity is the named threat.
  6. present: Spoofed FIU caller ID plus an HR pretext is more specific than emergency or situation.
  7. present: Requests for codes, passwords, or two-factor verification are the specific information-theft lure.
  8. present: Phishing attacks on personal cell phones via spoofed campus numbers name the hazard.
  9. present: Disguise their identity and try to gain personal and confidential information is the threat description.
  10. present: Tax-season increase language still refers to these phishing attacks, a specific type.
  11. present: Access to their FIU account is the goal of the named spoofing scheme.
  12. present: Caller-ID spoofing of an FIU phone number is the concrete crime method.
  13. present: Fake Human Resources calls asking for personal identifying information are the hazard.
  14. present: Do not accept an unsolicited password reset or DUO push because that is the phishing vector.
  15. present: The threat is social-engineering phone phishing, not an unnamed incident.
  16. present: Falsified caller ID to harvest codes and passwords is a specific named attack.
  17. present: FIU account takeover via spoofed HR calls is the hazard being warned.
  18. present: Phone number spoofing is defined in the text as the attack type.
  19. present: Personal cell phones of FIU employees are the target of this specified phishing.
  20. present: Two-factor verification prompts the user did not initiate are part of the described threat.
  21. present: The hazard is a phishing scam using spoofed FIU numbers and an HR script.
  22. present: Confidential or personal identifying information is what the spoofed caller tries to steal.
  23. present: Legitimate-looking FIU phone number that is not legitimate is the spoof threat.
  24. present: Human Resources impersonation on the phone is a specific threat rather than generic crime.
  25. present: Victim of a phishing scam at work refers back to this caller-ID spoof, a named hazard.
• Locationabsent8/25

  Final assessment

  L 8/25 majority absent. No building, hall, or street is named; eight passes treated at work or campus community as a where.

  Where the threat is. Saying whether danger is in a specific building, a part of campus, or area-wide lets people judge their own proximity and choose a safe direction. Without a where, a warning is hard to act on precisely.

  See all 25 individual reads

  1. absent: No building, hall, street, or mapped campus point is named as a scene.
  2. present: Campus community in the Clery sentence is a campus where cue.
  3. absent: Personal cell phones are devices, not a geographic location.
  4. present: Phishing scam at work locates the victimization in the workplace.
  5. absent: A legitimate FIU phone number is a caller-ID string, not a place.
  6. absent: Campus community in the footer names the audience, not a hall or block.
  7. present: Threat to the campus community includes campus as the place of concern.
  8. absent: Human Resources is a spoofed identity, not a mapped office site of the crime.
  9. absent: FIU account and FIU system are digital resources, not buildings.
  10. present: At work in the victim paragraph is a place-of-work location stamp.
  11. absent: There is no on campus, the area, or named facility as an incident site.
  12. absent: The FCC complaint URL is not a campus location.
  13. present: FIU employees on campus-related systems imply the university as the setting.
  14. absent: Calls to personal cell phones can occur anywhere, and no such place is given.
  15. absent: Tax season is a time frame, not a place.
  16. present: The timely warning is addressed as a continuing threat to the campus community, a campus place.
  17. absent: Security@fiu.edu is a contact, not a scene.
  18. absent: Two-factor verification and DUO are authentication channels, not locations.
  19. absent: At work describes employment context rather than a building or street.
  20. present: Work in at work is a location word, even if no building is named.
  21. absent: Nothing like a hall name, apartment complex, or street block appears.
  22. absent: Phone, text, or email are modes, not mapped places.
  23. absent: The Clery line still only says campus community as audience, not a site.
  24. present: Campus community plus FIU systems together are read as an on-campus where.
  25. absent: No MMC or other campus-area code locates the spoofed calls.
• Guidancepresent25/25

  Final assessment

  G 25/25 majority present. Hang up, do not share codes, change your password immediately, and contact FIU Security Office are recipient actions.

  The protective action to take. A clear, specific instruction, such as shelter in place, evacuate, avoid the area, or run-hide-fight, drives faster and more correct protective behavior than describing the threat alone.

  See all 25 individual reads

  1. present: Kindly hang up and contact the company directly to verify the request is protective instruction.
  2. present: Be extremely careful with providing any confidential or personal identifying information is second-person guidance.
  3. present: If you did not initiate a password reset, do not accept it is a do-not-comply order.
  4. present: Change your password immediately is a protective action for the recipient.
  5. present: Notify your supervisor and contact the FIU Security Office is recipient reporting guidance.
  6. present: File a complaint with the FCC is an instructed follow-up action.
  7. present: Stay vigilant and not fall victim is an explicit caution to the reader.
  8. present: Hang up rather than stay on a spoofed HR call is the core protective step.
  9. present: Contact the company or organization directly to verify authenticity tells people what to do.
  10. present: Do not share confidential or personal information on an inbound call, as FIU will never ask that way.
  11. present: Call-the-security-office at security@fiu.edu counts as call-police-style G.
  12. present: Do not accept an unsolicited DUO push, call, or text is instructed refusal.
  13. present: Change your password immediately if personal information was provided is remediation guidance.
  14. present: Extremely careful with codes, passwords, or two-factor verification is protective instruction.
  15. present: Hang up, then verify out of band, is a two-step recipient action.
  16. present: Do not fall victim to these phishing attacks is guidance aimed at the reader.
  17. present: Unless you are actively authenticating, do not treat a code prompt as real, which is instruction.
  18. present: Notify your supervisor is a directed workplace protective report.
  19. present: File an FCC complaint at the consumercomplaints URL is an action the recipient should take.
  20. present: Be extremely careful over the phone, via text, or email is channel-specific guidance.
  21. present: Kindly hang up is an imperative protective act, not a description of police work.
  22. present: Contact FIU Security Office if you think you have been the victim is a call-for-help instruction.
  23. present: Do not provide personal identifying information to the inbound caller is the refuse-the-lure order.
  24. present: Verify the authenticity of the request by contacting the organization directly is guidance.
  25. present: Password change plus supervisor notify plus Security Office email are stacked recipient actions.
• Timepresent25/25

  Final assessment

  T 25/25 majority present. January 20, 2023 dates the bulletin, and change your password immediately uses immediately.

  When the message applies. A timestamp, the word now or immediately, or a phrase like until further notice tells the reader whether the danger is current and how quickly to act.

  See all 25 individual reads

  1. present: TIMELY WARNING BULLETIN January 20, 2023 puts a calendar date on the notice.
  2. present: January 20, 2023 is an explicit date, which satisfies Time.
  3. present: Change your password immediately uses immediately, a listed Time cue.
  4. present: The header date January 20, 2023 and immediately in the password sentence both supply when.
  5. present: Dated January 20, 2023, the bulletin meets the date prong of Time.
  6. present: Immediately in change your password immediately is a recency word the rubric lists.
  7. present: January 20, 2023 is the product date on the first line.
  8. present: Time is present from the January 20, 2023 masthead even without a clock.
  9. present: Next couple of months during tax season is a time frame, and the header also dates the notice.
  10. present: The warning is dated January 20, 2023 rather than undated.
  11. present: Calendar date January 20, 2023 is printed in the title.
  12. present: Immediately after personal information was provided is an explicit Time word.
  13. present: January 20 plus 2023 is a complete date stamp.
  14. present: Time coded present: January 20, 2023 on the bulletin line.
  15. present: The password-reset advice uses immediately, which counts even if the date were absent.
  16. present: Header timestamp is January 20, 2023.
  17. present: Date-only still counts, and that date is January 20, 2023.
  18. present: Tax season plus January 20, 2023 together are temporal cues; the date alone is enough.
  19. present: The first line supplies January 20, 2023 as when.
  20. present: Change your password immediately is the immediately token the Time rubric accepts.
  21. present: A dated timely-warning bulletin of January 20, 2023 meets Time.
  22. present: No clock is required when January 20, 2023 is present.
  23. present: The year 2023 and the day January 20 date the product.
  24. present: Time is January 20, 2023 and the word immediately in the remediation line.
  25. present: Explicit calendar dating is present: January 20, 2023.
• Impactpresent25/25

  Final assessment

  I 25/25 majority present. Account access and theft of personal information are stated harms, and the Clery close states a serious or continuing threat.

  What the hazard could do to the people in its path. Beyond naming the threat, a complete warning conveys its potential consequences or severity, such as that a tornado can level buildings or that a leak could be explosive, so recipients grasp how much danger they are in. Research on warning message content finds that a concrete impact statement helps people personalize their risk and act sooner.

  See all 25 individual reads

  1. present: The Clery footer says the incident may pose a serious or continuing threat to the campus community.
  2. present: Serious or continuing threat is severity language beyond the phishing label.
  3. present: Gain access to their FIU account states account-compromise harm.
  4. present: Not fall victim to these phishing attacks frames people as harmed.
  5. present: Try to gain personal and confidential information states the privacy harm sought.
  6. present: May pose a serious threat is consequence wording, not just phone number spoofing.
  7. present: Continuing threat during tax season is paired with Clery serious-or-continuing language.
  8. present: Victim of a phishing scam plus serious threat together state impact.
  9. present: The closing paragraph frames a serious or continuing threat, a consequence cue.
  10. present: Account takeover via stolen codes is the stated harm to the FIU account.
  11. present: Serious or continuing threat is the impact phrase, separate from naming spoofing.
  12. present: Personal and confidential information harvested is a stated injury to privacy.
  13. present: The bulletin is issued because the incident may pose a serious or continuing threat.
  14. present: Fall victim names harm; the Clery sentence adds severity.
  15. present: Campus community faces a serious or continuing threat, which is impact.
  16. present: Gain access to their FIU account is what the attack would do to the person, a consequence.
  17. present: Clery serious-or-continuing-threat language supplies Impact beyond the hazard name.
  18. present: Confidential information loss is described as the attacker's aim and the harm.
  19. present: Impact is both data theft and a serious continuing campus threat.
  20. present: May pose a serious or continuing threat states how grave the risk is.
  21. present: The Clery Act close reports a threat that may be serious or continuing for the campus.
  22. present: Being asked for codes and passwords is aimed at account harm, and the footer states a serious threat.
  23. present: Severity is written as serious or continuing threat, not merely phishing.
  24. present: Harm is stolen personal information, account access, and a serious campus threat.
  25. present: An incident that may pose a serious or continuing threat is impact language in that footer.