Could the GoDaddy employee self-phishing test constitute a breach of contract? Recently, GoDaddy executed a self-phishing test against its own employees. The message that employees received said that they could claim their holiday bonus by submitting their contact details on some website: From: Happyholiday@Godaddy.com Date: Mon 12/14/2020 Subject: 2020 Holiday Party Happy Holiday GoDaddy! 2020 has been a record year for GoDaddy, thanks to you! Though we cannot celebrate during our annual Holiday Party, we want to show our appreciation and share a $650 one-time Holiday bonus! To ensure that you receive your one-time bonus in time for the Holidays, please select your location and fill in the details by Friday, December 18th. (Link for US) (Link for EMEA) Any submittals after the cutoff will not be accepted and you will not receive the one-time bonus of $650 (free money, claim it now!) We look forward to celebrating with you again, in person next year! The company is making the ~500 employees who followed the link retake their Security Awareness Social Engineering training, and presumably not paying out. So, does that constitute a breach of contract? There was an offer, acceptance, and consideration (the victim submitted personal information). The only thing that makes this exchange not routine is that the transaction happened on a medium that the employer deemed inappropriate. But that's an arbitrary designation on the part of the employer that can't invalidate the contract, right? The difference between usual phishing and this situation is that you usually can't pin down the identity of the scammers, and therefore can't enforce compliance. But the company, in their follow-up e-mail, has pretty much admitted to having authored the offer and confirmed that they received the payment request from victims: “You’re getting this email because you failed our recent phishing test,” the company’s chief security officer Demetrius Comes wrote. “You will need to retake the Security Awareness Social Engineering training.” Sure, the victim employees will now have to retake a training course, but they should be eligible for the $650 bonus now, and could sue for breach of contract to claim it, right? Is there any flaw in this reasoning?
Could the GoDaddy employee self-phishing test constitute a breach of contract? No. There is no contract. It was only the announcement of a gift. That gift might have been unexpected, especially if no similar bonus was given in previous years. The employee's act of filling in his information does not seemingly amount to &quot;consideration&quot;. Filling the data was portrayed as the step to facilitate the delivery of the bonus. Your description --or the article you shared-- has no indication that the employee's fill-in details were devised to benefit the company. Had the company's message been drafted in a way that qualifies it as an offer of contract, the description would be inconclusive because there are no details about: The exact URLs for &quot;(Link for US)&quot; and &quot;(Link for EMEA)&quot;: If the URLs were an alteration of the company's domain, it would be unreasonable for the employee to presume that the offer was legitimate. What data the &quot;failed&quot; employees filled in: Being asked to provide information unrelated to the alleged bonus should have raised suspicions. The contents of the Security Awareness training and what alertness could be reasonably expected from the email recipients even if no training were provided. In the case of companies such as GoDaddy (being in the business of web domains and hosting), one would expect many of its employees (except janitors, etc.) to be more careful or judicious on matters of social engineering than in other industries with less exposure to Internet scams.
does the email chain above set out a legally binding contract, would it stand up to the test in a court Generally speaking, yes, unless you signed a "more formal" contract thereafter. The more formal contract would supersede the email chain. Furthermore, the subsequent conduct by both parties evidences the existence of a contract. The fact that you have been provided with the service and that you have been charged for these ~12 months evidences the formation and existence of a contract. is the breach of contract sufficient to give us grounds to terminate the contract? Yes. To substantiate a claim of breach of contract, you will need to provide evidence that the "24/7/365 support line" is missing or unacceptably subpar in that it has caused you losses (such as downtime and consequent impact on your operations), or that such pattern of service disruptions would subject your company to imminent risk of losses if you were forced to stay in the contract for the remaining ~24 months (obviously, you will need to establish that this item or feature is not just incidental to the contract).
There is no real answer to that question at this point. If on filed such a suit, it would probably be under a negligence theory. You would sue: Forbes, because they're the website the user visited? The ad network that provided a vector for infection and didn't properly check their content? The makers of the ad, because they made the ad with malicious intent? and anyone else who might have been negligent. You then have to prove they were negligent. Can the user sue the responsible party for damages? You can sue anyone for anything. The problem is winning. Does it make a difference whether the user has taken due diligence with software updates and patches? It might. Contributory negligence would be an obvious defense to such a suit.
Don't do it. It is of course breach of contract when you signed a contract with no intention to fulfil it. However, you are talking about Germany. German employers take a very dim view of this. While a UK employer would say "good riddance" and do nothing, many German employers would see that as a personal insult. It's something that you just don't do in Germany. There's a good chance that they will do what they can to make you miserable if you do this. For example, inform authorities that you just cancelled your contract which may get a visa cancelled. Or tell the company that you want to start with, which will also take a very dim view of this. Or sue you for damages, not because they want to get the money, but to make you miserable. On the other hand, if they send you a contract, and you sign it, you have a contract.
Go to know that you live in Washington. Per RCW 49.48.210, They must give you written notice with their evidence. Per RCW 49.48.210, section 3, you can (and should) request a review of the employer findings. Since the employer gave you the money, and you nor they saw any error until now, you may be protected under estoppel (WAC 388-02-0495). In the response letter, I would write something along the lines of " [Company Name] has paid IAW my expected rate and acted correctly when I received my money. I have also spent the money in good faith. Indeed, I still cannot see that any overpayment has actually happened. Please send me exact details why you believe that I have been overpaid, and why you believe that estoppel does not apply. Until this manner has been resolved per RCW 49.48.210, section 3, I request that you continue to pay my wages at normal rate for my time. I do not accept liability for the actions or inactions of [company name] and the claimed overpayment." Get receipt that the employer received the notice. Because it is in review, they don't have the right to garnish your wages. Challenge everything at the review. If something was changed or edited, challenge that. I would open up a new thread if they did that much. Best of luck
In case a company is flooded by such &quot;asymmetric&quot; requests, how should a company react? Although article 12.5 refers to singular &quot;a data subject&quot;, it can be inferred that exposing the controller to significant expenses is not part of the legislative intent. Accordingly, the company may have requesters choose between paying a reasonable fee for the ensuing administrative costs or withdrawing the requirement that delivery be by postal mail. The bad faith scenario you outline seems to be a non-sequitur, since generally a pattern (or a high number) of requests for postal mail delivery should prompt the controller to suspect that some or many might not be legitimate. A requester with bad intentions would be unable to prove the identity of the various data subjects he impersonates or alleges to represent.
Clearly in this case the writing does not reflect your actual agreement. If you were to bill for 1.5x your normal rate for hours over 40/week, relying on the writing, and it came to court, you might win, based on the general rule that matters explicitly covered in the written agreement are treated as final, and evidence of contradictory oral agreements are often not accepted to contradict the contract document. This is known as the parole evidence rule. But you don't plan to issue such a bill, so that won't come up. I don't see that you are at any legal risk. But you could send the client a letter saying that you signed the contract document so as not to hold the job up, but you think there is a mistake in it (pointing out exactly where and what the error is). This would help establish your ethics and good faith, so that if somehow there was a problem over this later (although that seems unlikely) you can't be accused of any improper actions. Keep a copy of any such letter. By the way, if you are an independent contractor, the governmental standard for overtime does not normally apply (in the US). If you are an employee of a consulting company, it may or may not, depending on your salary level and the kind of work you do. An independent contractor can contract for a higher rate for overtime hours, if the client is willing to agree. Many clients will not be willing.
Suppose I obtain the ability to access someone else's cryptocurrency. This sounds like fraud e.g. I overheard them saying the password to their wallet out loud or I am a custodian of their assets. Nope, STILL fraud, possibly even Computer Misuse aka hacking... and because you use internet: it's Wire Fraud I now borrow those assets, keep them for some period of time, and then return them, without the owner's consent. hmmm, let's take california... Luckjy you, it is not embezzlement because you were not entrusted with the cryptocurrency, you gave yourself access. 503. Embezzlement is the fraudulent appropriation of property by a person to whom it has been intrusted. No it is plainly... theft under California law: 484. (a) Every person who shall feloniously steal, take, carry, lead, or drive away the personal property of another, or who shall fraudulently appropriate property which has been entrusted to him or her, or who shall knowingly and designedly, by any false or fraudulent representation or pretense, defraud any other person of money, labor or real or personal property, or who causes or procures others to report falsely of his or her wealth or mercantile character and by thus imposing upon any person, obtains credit and thereby fraudulently gets or obtains possession of money, or property or obtains the labor or service of another, is guilty of theft. In determining the value of the property obtained, for the purposes of this section, the reasonable and fair market value shall be the test, and in determining the value of services received the contract price shall be the test. If there be no contract price, the reasonable and going wage for the service rendered shall govern. For the purposes of this section, any false or fraudulent representation or pretense made shall be treated as continuing, so as to cover any money, property or service received as a result thereof, and the complaint, information or indictment may charge that the crime was committed on any date during the particular period in question. The hiring of any additional employee or employees without advising each of them of every labor claim due and unpaid and every judgment that the employer has been unable to meet shall be prima facie evidence of intent to defraud. Giving it back doesn't matter. The person taking the crypto for any amount of time without being entitled to them is committing theft. You see, California doesn't interest that you just want to borrow. They don't even require Mens Rea for the mere taking - only for fraudulent pretense there is an intent question. In fact, it might even be automatically Grand Theft: 484d. As used in this section and Sections 484e to 484j, inclusive:[...] (2) “Access card” means any card, plate, code, account number, or other means of account access that can be used, alone or in conjunction with another access card, to obtain money, goods, services, or any other thing of value, or that can be used to initiate a transfer of funds, other than a transfer originated solely by a paper instrument. 484e. (a) Every person who, with intent to defraud, sells, transfers, or conveys, an access card, without the cardholder’s or issuer’s consent, is guilty of grand theft. YIKES! and now, intent to defraud comes in, but that is actually minimal: that just means taking without being allowed to by the owner in many cases.