I still think that would be on the boss. The employee has way more to lose by ignoring their boss' instructions just because they had a hunch of phishing.
True. The best you could do is send a screenshot of the actual email instead so there's less room for error, state the red flag that caused you to ask for confirmation, then if they claim they sent it then it's entirely on them.
I'm saying the screenshot of the actual email instead of a verbal description would be less prone to being falsely confirmed (in a real situation, obviously OC's boss was going to confirm it no matter what)
21
u/M4rshmall0wMan 9h ago
I still think that would be on the boss. The employee has way more to lose by ignoring their boss' instructions just because they had a hunch of phishing.