Here are two examples of phishing emails received by employees of Lawrence General Hospital in Massachusetts. They appear to come from the CEO because they have the CEO’s name, but the email address isn’t quite right, says Alexander Laham, information security manager. “If you glance at it, you think it’s from the CEO,” he notes, and that’s how people get duped into clicking on links that invite malware or agree to do things against their own interests or the organization’s (see story, p. 1). “The scammer will hope you won’t pay attention to the fact that the email address is bogus,” he says. Employees should be wary of emails from executives that say “external” on them. Even though executives may have a Gmail or other personal email address, they would have access to their hospital email account on their phone and would use it to communicate hospital business, Laham says. “The entire point of phishing is to play on people’s emotions,” he says.