TL;DR: Workplace open enrollment for 401(k) and benefits typically runs in the fall, when employees are reviewing unfamiliar paperwork and portals under a hard company deadline. Access your benefits portal only by typing the address directly or using your employer's intranet link, and confirm any unusual email with HR through a known internal channel before entering credentials.
👉 Check my digital footprint — free 30-second check →
Workplace open enrollment for 401(k) and benefits typically runs in the fall, when employees are reviewing unfamiliar paperwork and portals under a hard company deadline.
How the Scam Plays Out
Phishing emails mimic the company's HR or benefits provider, asking employees to 'confirm' login credentials or personal details on a fake portal that closely copies the real enrollment site.
How to Protect Yourself
Access your benefits portal only by typing the address directly or using your employer's intranet link, and confirm any unusual email with HR through a known internal channel before entering credentials.
If this looks similar to something else you've seen, it's worth reading Black Friday and Cyber Monday Scams to Avoid.
This pattern shows up elsewhere too — see End-of-Summer College Move-In Scams.
Frequently Asked Questions
When does this typically happen?
Workplace open enrollment for 401(k) and benefits typically runs in the fall, when employees are reviewing unfamiliar paperwork and portals under a hard company deadline.
What tactics are used?
Phishing emails mimic the company's HR or benefits provider, asking employees to 'confirm' login credentials or personal details on a fake portal that closely copies the real enrollment site.
How can I protect myself?
Access your benefits portal only by typing the address directly or using your employer's intranet link, and confirm any unusual email with HR through a known internal channel before entering credentials.
What should I do if I’ve already been targeted?
Stop all payments immediately, contact your bank or card issuer to see if a transaction can be reversed or flagged, and report the incident to the appropriate consumer protection body.