Train workers in U.K. promised phony bonus as part of cybersecurity test

Train workers under the impression they were on the fast-track to a bonus after months of toiling amid the coronavirus pandemic were shocked to learn the offer was nothing more than a cybersecurity test engineered by their employers.

On April 21, more than 2,500 West Midlands Trains staff members in the U.K. received an email from managing director Julian Edwards, thanking them for their dedication over the past year during COVID-19, the Guardian reported. The note also promised they receive a one-time payment as a thank you after “huge strain was placed upon a large number of our workforce.”

At the bottom of the message, workers were encouraged to click a link for more information. Those who did however, were hit back with an email explaining they’d just fallen victim to a “phishing simulation test” and that they would not be receiving any additional funds.

“This was a test designed by our IT team to entice you to click the link and used both the promise of thanks and financial reward,” it read.

Manuel Cortes, head of the Transport Salaried Staffs’ Association (TSSA), condemned the trick as “crass and reprehensible,” noting that any other tactic could have been used to administer a security test.

“This was a cynical and shocking stunt by West Midlands Trains, designed to trick employees who have been on the front line throughout this terrible pandemic – ensuring essential workers were able to travel,” he said in a statement.

“The company must now account for their totally crass and reprehensible behavior. They could and should have used any other pretext to test their internet security. It’s almost beyond belief that they chose to falsely offer a bonus to workers who have done so much in the fight against this virus.”

A West Midlands Trains spokesperson in response told the Guardian that the railway company takes “cybersecurity very seriously. We run regular training and it’s important to test your resilience.”

“The design of the email was just the sort of thing a criminal organisation would use – and thankfully it was an exercise without the consequences of a real attack.”