When we stopped printing payslips in 2021, the payroll team chose the simplest protection available. Each payslip went out as a PDF attached to an email, locked with a password, and the password was the employee's date of birth. Nobody had to be told it, nobody forgot it, and the service desk never had a single call about it.
I came to it through a complaint. An employee had separated from her partner, who still used the family laptop, and her payslip, with her salary, her bank details and her national insurance number, had been opened in the shared mail client. He knew her date of birth. Of course he did.
The problem was much wider than one household. A date of birth is not a secret. It is on the birthday list in most of our offices, in the HR system that a hundred people can read, and on the social media profiles of a good share of our staff. For a working adult there are only around twenty thousand plausible values, which a freely available tool will try against a PDF in seconds. And payslips travel. People forward them to mortgage brokers, letting agents and personal email accounts, so the attachment lives on in places we will never see, protected by something close to public.
The scheme had been chosen because it never generated a support call. For the same reason, nobody had ever tested it by trying to get in.
Payslips no longer leave us as attachments. Staff read them in the self service portal, behind the same sign in and second factor as everything else, and the email only says that a new payslip is available. Anyone who needs a copy for a lender downloads it themselves, and we can see that it happened. Warehouse staff and drivers without a company mailbox enrol a personal phone at induction. The old attachments were purged from our own mail system, which was the part our legal team cared about most.
Calls to payroll rose for about six weeks and then settled below where they had been before.
A password that can be read off a birthday card identifies a person. It does not protect anything. These days a control that has never caused anybody any friction is one of the first things I check, because friction is often the only evidence that a control is doing something.
– Serguey Shinder
Top comments (0)