A Train Company Offered Workers a COVID Bonus, But It Was Just a Phishing Test

A train company pulled a "cynical and shocking stunt" on its staff by conducting a phishing simulation test under the guise of a false promise of bonuses to employees for their hard work during the pandemic.

On the 21st of April, the UK’s West Midlands Trains (WMT) sent an email from manager Julian Edwards to approximately 2,500 staff thanking them for their hard work in the past year. The email suggested that workers could expect a financial reward after a “huge strain was placed upon a large number of our workforce”.

“This has not been easy for any of us and we would like to offer you a one-off payment to say thank you for all of your hard work over the past 12 months or so,” the email said.

“Please visit the following link which has a personal message from Julian Edwards as well as the information of your one-off payment… Again, many thanks for your hard work and I hope that this gift will inspire you to keep up the good work.”

But workers who clicked the link in the hope of a COVID bonus for their efforts were emailed back to be informed that it was in fact a “phishing simulation test” which was “designed by our IT team to entice you to click the link and used both the promise of thanks and financial reward to try and convince you to provide your details”.

Manuel Cortes, General Secretary of the TSSA union, which represents managers, clerical and station staff, and some depot staff, said: “This was a cynical and shocking stunt by West Midlands Trains, designed to trick employees who have been on the front line throughout this terrible pandemic – ensuring essential workers were able to travel.

“The company must now account for their totally crass and reprehensible behaviour. They could and should have used any other pretext to test their internet security. It’s almost beyond belief that they chose to falsely offer a bonus to workers who have done so much in the fight against this virus.

“Our members have made real sacrifices these past 12 months and more. Some WMT staff have caught the disease at work, one has tragically died, and others have placed family members at great risk.

“We need to know who sanctioned this email and we need an apology. Moreover, having fraudulently held out the prospect of a payment to staff, WMT must now be as good as their word and stump up a bonus to each and every worker. 

“In that way the company can begin to right a wrong which has needlessly caused so much hurt.” 

Rail worker and TSSA member Belly Mujinga died of COVID after being spat at while working at London’s Victoria Station. An inquest into her death is to be held.

A West Midlands Trains spokesperson said: “We take cybersecurity very seriously, providing regular training on the subject and we run exercises to test our resilience.

“Fraud cost the transport industry billions of pounds every year. This important test was deliberately designed with the sort of language used by real cyber criminals but without the damaging consequences.”