Qld cops caught out by internal fake email scam offering five per cent pay rise

Thousands of Qld police officers have been caught out by a controversial phishing scam email that was internally sent asking them to click a link about a fake five per cent pay rise.

Queensland Police has sent a controversial phishing scam email to officers causing widespread confusion. Picture: Glenn Campbell

Queensland police officers have been caught out in a controversial and internally-sent phishing scam email after clicking a link about a fake five per cent pay rise, causing widespread confusion amid pay negotiations with unions.

The Courier-Mail can reveal police officers received the email on Tuesday, encouraging them to vote on a proposed pay rise.

It’s understood the email was generated internally as a “training exercise” to test staff’s willingness to engage in phishing emails.

It comes amid negotiations for thousands of enterprise bargaining agreements, with police, nurses and teachers among the cohorts to have their agreements expire within months.

“This email is to confirm our intention to request a further 5% increase to your salary as part of the Enterprise Bargaining Agreement (EBA),” the email sent to thousands of officers said.

“To indicate your support, please click on the following link “I support a 5% increase”. More details on the latest EBA proposal can be found here.”

While internal phishing emails are sent out by companies to inform and teach staff of cybersecurity risks, the move has been criticised due to the ongoing sensitive negotiations of EBAs.

Queensland Police Union president Shane Prior said the email was concerning and showed a lack of judgment amid negotiations for thousands of workers. He urged the Commissioner investigate how it happened.

Queensland Police Union president Shane Prior slammed the email. Photo: Steve Pohlner

“I’m troubled that a senior manager in the police service would think this would be an appropriate scam to entrap their own workforce,” Mr Prior told The Courier-Mail.

“The lack of judgement and poor decision making skills around this ‘set up’ is something the Commissioner needs to personally investigate.

“My concern is for the hardworking frontline police who became entangled in this ridiculous training exercise and now will probably waste time undertaking online instruction instead of answering calls for help from the community.”

Mr Prior used the phishing email to raise issues with the real agreement being negotiated.

“I believe the five per cent base pay increase a year was the only element in this email that wasn’t a fantasy,” he said.

“It’s clear the police service has an indication this will be the starting point for the government wages policy and our negotiating team will be working to have that percentage increased to help our members deal with the additional risk they face at work along with cost of living pressures.

“We enter Enterprise Bargaining discussions in good faith but this now gives me concerns about the integrity of some of those people at the table.”

The email also claimed it was a confidential document and should not be forwarded, with a supposed secure link to DocuSign.
A police spokesman said the service had a robust cyber security awareness program in place which included modules and exercises to recognise and mitigate security threats.

Once QPS senior management became aware of the email they withdrew the security campaign and have reviewed the process to ensure it doesn’t happen again, the spokesman said.

“As part of the QPS Cyber Security proactive phishing awareness program, a phishing email with the subject “5% Salary Increase - New Enterprise Bargaining Agreement” was sent to some QPS, QFD and QAS members, as part of our QPS’ cyber security shared service arrangements,” the spokesman said.

“This campaign was designed to educate and exercise employees in identifying and reporting phishing emails.

“Utilising standard phishing templates, the topic of Enterprise Bargaining Agreements was generated for the campaign. The templates offered by the phishing platform are designed to mimic real life campaigns. Upon clicking the link in the phishing email, the recipient receives awareness material identifying it as a phishing email.”

“Upon notification that this email had been generated, the QPS senior management team immediately withdrew the campaign and have reviewed the process to ensure this does not occur in the future.”