How Should HR Route a Request When Sender Identity Is Uncertain?

Operating question. When an HR inbox receives a plausible employee request from an uncertain sender, can support route it safely without exposing records, resetting credentials, changing payroll details, or accusing the sender? The study examines evidence states, out-of-band verification, minimum disclosure, and ownership boundaries. It does not authenticate a real person, diagnose an attack, or decide that a request is legitimate. Build 120 synthetic messages using fictional people, domains, requests, and attachments: normal addresses, lookalike domains, compromised mailboxes, personal accounts, changed phones, spoofed names, executive impersonation, payroll changes, leave questions, certificate requests, suspicious attachments, and harmless typos. Some suspicious-looking messages are legitimate; some polished messages are malicious.

Define intake states: received, machine checks available, sender relationship known, identity evidence insufficient, verification route initiated, verified for a defined action, verification failed, security review, HR owner review, fulfilled, declined, and cannot determine. Verified always names method, time, assurance limit, and action scope. A previous conversation does not authorize a new sensitive request forever, and a secure mailbox does not prove who is typing. Preserve the original safely: approved transport headers, mailbox, received instant, address fields, links as inert text, attachment metadata, request category, claimed urgency, conversation identifiers, and evidence hash. Sanitized views expose only the fields needed by each owner.

Routing starts with consequence, not confidence theatre. A general policy question may need little identity evidence; a bank-detail change, personnel-record release, reset, or sensitive disclosure needs the owner-defined route. The coordinator classifies requested action and applies the prescribed pause and verification process. They do not invent risk scores, approve exceptions, or trust writing style. Out-of-band verification is tested against poisoned contact data. One case calls the number inside the suspicious email, another uses an approved directory, and a third discovers that the directory change is pending. Reviewers document contact provenance and stop when independence is not established.

A conversation-hijack scenario begins with a legitimate thread and inserts a later message changing payment details. Matching subject and quoted history are insufficient. The process freezes the change, preserves both messages, checks the approved route, and alerts security and payroll owners without broadcasting financial information. A later confirmation is scoped to the change; it does not prove who sent every earlier message. Minimum-disclosure replies reveal neither employment status nor held records until the route permits it. Templates acknowledge receipt, direct the requester to a trusted channel, or state review continues without repeating account, leave, address, manager, or security details.

Compare ordinary mailbox triage with a request-type and evidence-state queue using the same messages, tools, and deadlines. Measure sensitive actions before verification, false accusations, unnecessary disclosure, missed suspicious patterns, wrong-owner routing, unsafe link interaction, verification completion, and service delay. Report harms separately: one unauthorized payroll change cannot be averaged away. Adversarial cases include valid forwarded mail failing authentication, malicious mail passing checks, an executive using an unfamiliar account, an unavailable approved contact method, and similar names. Cannot determine and escalation are valid; blocking every unfamiliar message may create its own denial-of-service and fairness harms.

Attachment handling uses harmless simulations. Record claimed and detected types, size, scanner result, isolation state, and authorized reviewer without opening content unsafely. A clean scan does not prove business legitimacy; a blocked file does not prove malicious intent. Security owners decide analysis and containment, HR owners decide information need, and coordinators communicate only approved status. CISA phishing guidance informs recognition and reporting rather than identifying a sender. NIST identity guidance distinguishes resolution, validation, and verification. CSF 2.0 frames governance, protection, detection, response, and recovery. NPC materials frame purpose, proportionality, accuracy, security, and disclosure.

Recovery follows an unauthorized change discovered after fulfillment. Link the request, verification evidence, action, affected systems, discovery, containment instructions, employee communication, and restoration acknowledgments. Do not edit history to make the request appear unverified from the start or hide that the control passed it. Check payroll, directory, benefits, document, and access systems individually, with unresolved paths assigned and reported. Analysis covers action-before-verification, route independence, disclosure failures, false and missed escalation, unsafe interaction, response time, correction coverage, and reviewer agreement. Every classification cites evidence and separates machine observation, identity conclusion, and owner decision.

Queue design prevents suspicion from becoming a permanent label on an employee record. Security-relevant evidence remains in its approved case system, while the HR service queue carries only the operational state and next owner. A message later shown to be legitimate is not rewritten as always trusted; the record preserves why verification was necessary with neutral language. Conversely, a message confirmed malicious does not justify exposing unrelated personnel information to analysts. The test measures whether roles can do their work with minimized views, whether temporary access expires, and whether search and reporting tools inadvertently surface sender allegations beyond their approved purpose.

Service-continuity cases remove the approved directory, identity platform, or security responder during an urgent request. Staff use the documented fallback, state its assurance limitations, and limit action to what that path permits. They do not substitute social-media profiles, caller familiarity, manager pressure, or data found inside the questionable message. A low-consequence question may receive public information while a sensitive change remains paused. The study records delay, employee impact, escalation attempts, and recovery once trusted systems return. This demonstrates whether safe routing can remain usable under disruption instead of forcing a choice between total shutdown and improvised verification.

Reviewer calibration uses unseen messages with deliberately conflicting signals. Each reviewer states the requested action, possible consequence, evidence available, trusted route, disclosure limit, owner, and next reversible step. Agreement on a vague suspicious label does not count; the decision must be traceable. Disagreement may show that request categories are unclear or that a machine signal is inaccessible. Owners revise the rule, and a fresh set tests the change. The qualitative audit also looks for repeated argument sequences and stock examples, because sender uncertainty requires scenario-specific reasoning about channel provenance, action scope, and recovery rather than a universal phishing checklist.

The decision brief reports the message population, mail systems, request types, assurance routes, observation window, exclusions, false positives, false negatives, boundary violations, service delays, and unresolved cases. It presents the strongest alternative explanation for each suspected control failure. A buyer can then distinguish a mail-authentication limitation from a routing error or unauthorized disclosure. Recommended pilots begin with reversible, low-consequence requests and named escalation owners. The conclusion expires after a change to email routing, directory authority, identity method, sensitive-action policy, or connected HR system, and it never claims that the provider can guarantee identity or eliminate social engineering.

Shift-handoff testing removes the first reviewer while several messages remain unresolved. The replacement receives an inert evidence summary, request consequence, verification attempts, disclosure limits, current owner, and next safe action. Active links and attachments are not copied into a new channel for convenience. The test watches for duplicated replies, repeated verification that burdens a legitimate employee, premature action, and lost security escalation. It also confirms that temporary mailbox or case access ends after coverage. This shows whether safe inbox administration depends on one person’s memory or survives a controlled operational transition with the same evidence and boundaries.

Limitations. Synthetic email cannot reproduce every provider, compromise, social context, or adversary. The exercise does not establish identity, employment status, intent, or legal duties, and cannot guarantee future security. It can test whether support avoids irreversible action while uncertainty is resolved. A buyer should request a sanitized inbox case, contact-route provenance, permissions, reply templates, attachment isolation evidence, false-positive review, and recovery drill. Sources checked October 5, 2026: CISA, “Recognize and Report Phishing,” https://www.cisa.gov/secure-our-world/recognize-and-report-phishing; NIST, “Identity Proofing Overview,” https://pages.nist.gov/800-63-4/sp800-63a/proofing/; NIST, “CSF 2.0,” https://www.nist.gov/publications/nist-cybersecurity-framework-csf-20; NPC, “The Data Privacy Act and Its IRR,” https://lawphil.net/statutes/repacts/ra2012/ra_10173_2012.html.