Open enrollment gives phishing lures a real deadline and a believable HR pretext. Learn how to prepare employees across email, chat, and voice.
Attackers love a deadline. HR supplies a very real one every fall.
For many employers, benefits open enrollment lands in October or November. Employees expect plan comparisons, contribution reminders, login links, vendor emails, and a firm closing date. They also expect at least one message that makes them wonder whether “coinsurance” was invented as a prank.
That mixture of urgency and confusion creates excellent cover for phishing. “Your 401(k) contribution failed.” “Re-verify your health plan.” “Final day to enroll.” Each message fits the season, asks for a plausible action, and can lead naturally to a login page or a call with a supposed benefits representative.
Most awareness programs treat phishing as a year-round category. Open enrollment deserves its own rehearsal because attackers aren’t imitating a random business process. They’re stepping into a live one, with a deadline employees can’t simply ignore.
The strongest lures borrow context the target already believes. Open enrollment arrives with plenty of it.
The seasonal timing gives the attacker credibility before the first sentence. A generic password-reset lure has to create a problem. An open enrollment lure only has to claim there’s a problem inside a process that’s already happening.
The best open enrollment phish usually isn’t flashy. It sounds administrative, mildly inconvenient, and important enough to handle before lunch. Recent campaigns have used fake “benefits review” notices that send employees to copied login pages, sometimes wrapped in language about secure documents or protected messages.
This table pairs common lures with the pressure they exploit and a safer path employees can use instead of following the message.
Lure | Why it works | Safer verification path |
“Your 401(k) contribution failed” | Money, payroll, and retirement losses feel immediate | Open the saved retirement portal or call the number on a prior statement |
“Re-verify your health plan” | Employees expect identity and dependent checks during enrollment | Navigate from the company intranet or benefits hub, not the message link |
“Final day to enroll” | A real deadline makes delay feel risky | Confirm the date in the HR calendar and sign in through the published portal |
“Benefits helpdesk: we need your code” | A helpful caller can make an MFA request sound procedural | End the call and contact HR through the internal directory; never share a code |
The wording will change. The safer behavior shouldn’t. Employees need a known route to the real portal, the real deadline, and a verified HR or benefits contact. Telling them to “look for suspicious emails” is less useful when a legitimate benefits email already looks like it was assembled by three vendors and a committee.
A 2026 analysis of a Benefits Review Notice scam illustrates the pattern: An official-sounding HR message, a prominent action button, and a fake sign-in page designed to collect credentials. Other variants imitate secure-message notifications or document-sharing tools. The story changes just enough to meet the employee where they expect paperwork.
Open enrollment is a workflow, so a convincing simulation should behave like one. An attacker can start with email, move into Slack or Teams, and finish with a phone call from the “benefits helpdesk.” Each channel reinforces the others.
The opening message may announce a plan change, a rejected contribution, a dependent-verification issue, or an expiring enrollment session. It can copy the employer’s logo, broker language, legal footer, and benefits calendar.
Email is useful because it provides the link or attachment that begins the journey. It’s also where many training programs stop. That leaves employees less prepared when the attacker follows up elsewhere.
A Slack or Teams message can appear to come from HR, a manager, or a benefits coordinator: “I saw your enrollment is still incomplete. Can you take care of it before 3 p.m.?” Even without a compromised internal account, a fake external workspace invitation or spoofed display name can add credibility.
Chat is fast, familiar, and visually compact. People inspect less context when the message looks like a routine nudge. They may also assume the platform has verified the sender, an assumption attackers are happy to borrow.
If the employee hesitates, a caller can offer to “help” with enrollment, verify a dependent, reset the portal, or resolve the failed contribution. The request may escalate from basic identity details to a password, push approval, or one-time code.
This is vishing with unusually good timing. The caller doesn’t have to invent a reason for HR to contact the employee. The organization already supplied one by opening enrollment.
An annual course can teach durable principles, but it rarely recreates the pressure of a real enrollment window. Timing changes how people interpret a message. “Final day to enroll” in March is odd. The same subject line in late October may be completely plausible.
Generic simulations also tend to isolate the channel. Employees receive an email, click or report it, and move on. A live attacker can adapt. If the link fails, they send a chat message. If the employee asks a question, they call. If HR has announced a new carrier, they copy that carrier’s name and vocabulary.
Effective security awareness training should connect knowledge to the moment it’s most likely to be tested. Open enrollment is ideal for a short, focused campaign because the organization knows the calendar, the approved vendors, the official portal, and the expected employee actions in advance.
The exercise can teach more than “don’t click.” It can teach where to click safely, how to verify a caller, what HR will never request, and how to report a suspicious message without losing the enrollment deadline.
A useful exercise mirrors the legitimate process without confusing employees about their actual coverage. HR and security need to design it together, set guardrails, and make the safe route unmistakable during the debrief.
A multi-channel phishing simulation measures more than click rate. Track reporting speed, verification behavior, repeat exposure, and whether employees use the official portal or internal directory when they’re placed under deadline pressure.
Training works better when the organization makes the secure action easier than the risky one. During open enrollment, that means reducing ambiguity before attackers can exploit it.
For organizations whose benefits choices interact with public coverage, remember that other enrollment windows may overlap. The federal Health Insurance Marketplace, for example, generally opens enrollment on November 1, with dates and deadlines published through HealthCare.gov. Attackers can borrow those public dates as readily as an employer’s internal schedule.
Open enrollment phishing works because the lure belongs in the employee’s week. The deadline is expected, the login is plausible, and the request may arrive through several channels. A once-a-year course can’t reproduce that context on demand.
Doppel’s Simulation platform helps organizations test coordinated social engineering across email, messaging, and voice, then turn the results into training grounded in the employee’s actual experience. That makes the exercise less like a pop quiz and more like practice for the workflow an attacker will copy.
The goal isn’t to make employees suspicious of every HR message until payroll sends a search party. It’s to give them a dependable verification route and enough practice to use it when an urgent benefits request lands at exactly the right time.
Would your employees verify an urgent benefits request that jumps from email to chat to phone? Request a Doppel demo to test the full workflow.
