59

Toward the end of the work day today, I received a meeting invitation via Outlook from my direct manager. I was in a meeting when I received the invitation, and he had already gone home by the time I got out.

The meeting invitation is for a meeting with the CEO, tomorrow morning, before work, at a hotel a few miles from our place of work. The subject is "Meeting with [CEO's first name]" and no further details were provided. The CEO and myself are the only listed attendees.

I've briefly met with our CEO in the past, since our company is a small government contractor. In more than a year that I've been with the company, I've never heard of anyone being asked to attend a meeting that wasn't either at our office or on-site with a customer. Our company has no relationship with the hotel that I know of. None of my coworkers appear to have received similar invitations.

This seems unprofessional at best. Should I accept this meeting? How should I reply to this?

Additional information: I do have my manager's phone number, but he has made it clear that he doesn't want to be contacted outside of work hours unless it's an emergency. I do not have the CEO's phone number.

  • 2
    Is it possible he added you by mistake? Maybe a VP has the same first couple of letters as you and he didn't notice your name when adding recipients in Outlook. – Hannover Fist Aug 15 '17 at 15:50
  • 29
    You are going to circle back and tell us what it was about, if you are at liberty to do so, right? – PoloHoleSet Aug 15 '17 at 15:56
  • 12
    The last time I got a meeting request like that, the company was being shut down and assets sold off... I was asked to lock everyone's passwords and keep the website up and running for the buyer. The only difference was that the early morning meeting was at the CEO's house, and I already knew him and had been to his house, so I knew it was legit. – Johnny Aug 15 '17 at 18:01
  • 23
    Seems like things didn't go too well for Brian. I wonder if we should send out a search party? – Strawberry Aug 16 '17 at 14:57
  • 3
    We're all curious what happened. Was it a scam? An update would be really nice. – Chris Sep 9 '17 at 8:28
104

You'v e already answered your own question in comments. If it "goes against your security training", then don't do it. Your CEO would also know your security training and wouldn't make you break it. (If it's some kind of test, then you definitely shouldn't attend)

This has several of the characteristics of a spoof email. The use of only the first name, the unusual meeting place, the short notice, the lack of detail - all are red flags. The use of first name only increases the chance that you will think the meeting is with someone you know. The short notice is so you don't have time to check it out. The meeting place outside the office is so the spoofer doesn't have to clear your security. And if course it's very easy to make an email look like it came from your boss.

It's not unknown for attackers to use emails like this to gain trust with employees, with a view to later extracting information from them. A small government contractor would be a prime target. The purpose is to make the employee think they are interacting with a legitimate colleague, when in fact they are interacting with an outsider. Using a first name only is a good technique since everybody will assume that "Jim" means the Jim they know. It may be luck or deliberate that they use the CEO's first name.

You should absolutely call your manager, and not attend if you can't reach him or he doesn't OK it.

One possible scenario is that if you go to this meeting you will find a person you don't know who says "I'm [CEO's first name]. You didn't think I was the CEO did you?". They may claim to be doing a special project and need information from you. You should of course give them no information until you have checked them out. Ask to see their security badge, and take a photograph of them and it (if they haven't mysteriously forgotten to bring it). The photograph is to give to the police if he doesn't check out.

  • 13
    @JoeStrazzere: If the options are "Not following an advice" vs. "Possible risk of company informations or even life"? Yeah I'd say it is. – Zaibis Aug 15 '17 at 12:02
  • 19
    @JoeStrazzere: Well, thats what should be done. But before hand a simple call to the manager asking for confirmation might work out. Sry Joe, but your stultification starts getting strange. Would you really expect some one stating to his manager "Hey Jim, I wasn't sure if there is a reason, you sent an invitation going against our security training. But since you told me only to call you in an emergency, I found it a better fit to first involve the police and the FBI."? – Zaibis Aug 15 '17 at 12:39
  • 10
    @JoeStrazzere No the point of only the first name is that the spoofer writes "Meeting with Jim", because everyone knows someone in the company called Jim, and assumes it is them. That it's the CEO's name is irrelevant. The OP only assumed it was the CEO, which completely backs up my point. – DJClayworth Aug 15 '17 at 13:02
  • 6
    @JoeStrazzere - I'd say having the manger confirm that they sent the invitation for a potentially questionable "meeting" off site would qualify as an emergency, or at least important enough to get them on the phone for a couple seconds. Not even "What's this all about?" but a "Did you actually send this to me? It's real?" confirmation. – PoloHoleSet Aug 15 '17 at 16:01
  • 5
    The title is "Meeting with Fred," but OP also said that the CEO was also an invitee, which would be more than just the first name on Outlook. – PoloHoleSet Aug 15 '17 at 16:02
66

Since the meeting came so late in the afternoon, and is due to commence a few hours before work tomorrow, if you don't feel comfortable for whatever reason the easiest way out is to apologise and simply say you can't make that time as you had other plans. Let them know you'd be happy to reschedule at a time during work hours, or if they need you out of hours you will need more notice.

42

Call your manager for confirmation, since you are doubtful and worried it might be dangerous.

If the meeting is valid, you can further express your concern regarding the location of the meeting, and understand what is the meeting for.

If the meeting is important and they insist to having the meeting over there, you have to decide yourself:

  • Go for the meeting and hope is just you overthinking.
  • Better be safe than sorry, politely decline the meeting and perhaps ask for reschedule.
  • 16
    This does have some of the hallmarks of a spoof email. Use of only the first name, vagueness, unlikely meeting place, short notice. – DJClayworth Aug 15 '17 at 7:31
  • 5
    @DJClayworth Regardless whether it is a spoof mail or not, he should call the person who created the invitation just to confirm. – BЈовић Aug 15 '17 at 9:52
2

Since you think the mail can be spoofed you should report this to the sender. If it's not from him there is a security problem in your company (hacked account). However make sure to check the mail address, maybe it is not managersname@yourcopmany.com but managersname@your-company.com. In this case you also should report this, so that your coworkers can be warned that this kind of spoofed mails are around and your IT-admin can block this domain on your mailserver.

Like @Joe stated, accept the meeting, maybe wait outside. Since you know your CEO personally the only thing you can loose is time if he doesn't show up. Hint: If you live in a dangerous country where strange thinks happen to people decline the meeting if it's not in an safe area.

0

This seems unprofessional at best, and inappropriate or even dangerous at worst (particularly if my manager's account was hacked).

Unprofessional? Inappropriate? Dangerous? You are imagining all this from a simple "Meeting with CEO" email? Or are you hiding something that you worry has just been exposed?

Try not to get carried away here. Assume positive intent until you have a real reason to worry.

Should I accept this meeting?

Yes.

How should I reply to this?

Something like "Thanks. I'll be there." should do.

You should have called your direct manager immediately and asked what the topic of the meeting was.

But since you didn't do that, accept the invitation and enjoy your breakfast. And try to keep your worries in check.

And if you still feel that nervous, arrive early, wait outside and go in when you see your CEO go in.

  • 35
    Hiding something? To think that a government contractor could get targeted by hackers looking for information isn't exactly far-fetched. As for inappropriate, I can't imagine a legitimate reason to have this meeting at a cheap hotel a few miles away when we have dozens of conference rooms available. And the lack of any information in the invitation to such an unconventional meeting is what I'm referring to as unprofessional. – Brian Aug 15 '17 at 1:34
  • 7
    Could you please provide some explanation to your answer? Like why I should blindly accept a meeting that goes against our security training, why I should have called someone who made it clear that he doesn't want to be called, or why you think my CEO would want surprise breakfast at a discount hotel several miles away when our office has a cafeteria and there are dozens of restaurants that are closer? – Brian Aug 15 '17 at 6:58
  • 26
    If the request "goes against your security training" then you absolutely shouldn't go. Nothing good can come of it. – DJClayworth Aug 15 '17 at 9:11
  • 11
    @JoeStrazzere Accepting an Outlook meeting from a manager to meet with the CEO isn't that crazy in itself. The strange location and lack of context or additional information is definitely suspect. I assume this also isn't normal at OP's company or it wouldn't raise flags really. – JMac Aug 15 '17 at 12:25
  • 12
    I would say no and replace "Thanks, I'll be there" with "I'm sorry but I can't attend on such short notice. Will be happy to discuss it with you at the office tomorrow if necessary". It is unreasonable to ask someone to meet outside of work and outside of work hours with less than 24 hours notice. Since security is a concern in this situation the short notice is yet another red flag (by not providing adequate time to authenticate the email and other details). – Doktor J Aug 15 '17 at 15:37

Not the answer you're looking for? Browse other questions tagged or ask your own question.