A recent Consumer Reports article that is a MUST read:
Employers beware: Companies are experiencing a wave of phishing scams that target employee paychecks. Here is the scenario: An employee receives from a company email account e-mail that mimics a familiar and trusted company service or resource, such as an e-signature request or a request to complete a survey. The e-mail asks the employee to click a link, access a website, or answer a few questions. Then it directs the employee to “confirm” his or her identity by providing his or her complete log-in credentials.