In June, Jason Ford received a call from the Australian Federal Police. They wanted to know why his credit card had been used to send packages to an Australian bank. The lender’s security team had called the authorities when they discovered this was an attempt to break into its computer systems.

Ford had stuffed gift boxes with brown shredded paper and a letter congratulating several staff members for their good work. The note was purportedly from Workhuman, an international company that provides software for human resources teams.