One email. One click. And, nearly a decade later, 114 guilty verdicts.

The Manchester City financial scandal started with something far less sophisticated than disguised sponsorship agreements, hidden payments, or Premier League financial regulations.

It started with phishing.

In January 2017, a senior Manchester City official received an email that appeared to come from someone at UEFA. It contained a link to what looked like a financial compliance report.

The employee clicked "download."

That was all it took.

The email wasn't from UEFA. It was a phishing attack tied to Rui Pinto, the Portuguese hacker behind Football Leaks. The click gave Pinto access to City's computer systems, from which he obtained thousands of internal emails and documents. Those documents eventually made their way to journalists, helped launch investigations by UEFA and the Premier League, and became part of the story that culminated last month with an independent Premier League commission finding City guilty of 114 of 115 charges. City denies wrongdoing and has appealed.
Think about that for a moment. One employee clicked one bad link. And the rest, as they say, is 114 guilty verdicts.

That happened in 2017. Phishing has gotten a lot more sophisticated since then.

Today's phishing email might perfectly mimic Microsoft, DocuSign, your bank, a customer, your CEO, or one of your vendors. Attackers can scrape LinkedIn and company websites to learn reporting relationships and job responsibilities. Generative AI makes it trivial to write polished, personalized emails without the bad grammar and awkward phrasing that used to give scams away.

And phishing isn't limited to email. It can arrive by text, Teams, Slack, social media, or even a phone call.

So what can an employer do?

Here are eight places to start.

1. Train employees to verify, not just recognize.

"Look for typos" is not a cybersecurity strategy anymore.

Employees need a simple rule: if an email unexpectedly asks you to click a link, download a file, enter credentials, move money, change banking information, or disclose sensitive information, verify the request through another channel.

Call the person. Open the website yourself instead of using the link. Start a new email using an address you already know.

The National Institute of Standards and Technology specifically recommends independently verifying suspicious or urgent requests rather than relying on contact information contained in the message itself.

2. Turn on multifactor authentication everywhere you can.

A stolen password shouldn't equal a stolen account.

Require MFA for email, cloud storage, payroll, HRIS platforms, remote access, financial systems, and especially administrator accounts.

Better still, move toward phishing-resistant MFA such as passkeys or FIDO security keys. Traditional text-message codes and one-time passwords are better than passwords alone, but sophisticated attackers can sometimes steal those, too. CISA and NIST both recommend phishing-resistant authentication for higher-risk accounts.

3. Stop giving everyone access to everything.

If one employee's account gets compromised, the attacker should not inherit the keys to the entire company.

Apply the principle of least privilege. Employees should have access only to the systems and information they actually need to do their jobs. Administrative access should be especially limited.

The smaller the compromised account's footprint, the smaller the potential blast radius.

4. Harden your email system.

Your employees should not be your only line of defense.

Use modern spam and malware filtering, safe-link scanning, attachment screening, and email authentication technologies such as SPF, DKIM, and DMARC.

DMARC, in particular, can make it harder for attackers to impersonate your company's domain in phishing campaigns.

5. Make reporting suspicious messages ridiculously easy.

Give employees a one-click "Report Phishing" button or an obvious place to forward questionable messages.

And don't punish people for raising false alarms.

I'd rather have IT review 50 legitimate emails than have an employee hesitate for 30 seconds over the one malicious email that matters.

Speed also matters after someone clicks. The sooner IT knows, the sooner it can disable accounts, revoke sessions, reset credentials, isolate devices, and determine what the attacker accessed.

6. Phish your own employees.

Run periodic simulated phishing exercises.

Not as a "gotcha." Not so HR can create a list of employees to discipline.

Use them to identify where your training and systems are failing.

Which kinds of messages fool people? Are executives more vulnerable to fake document-sharing notices? Is accounting susceptible to vendor-payment scams? Are employees entering credentials into fake Microsoft login pages?

Train against the attacks your workforce is actually falling for.

7. Protect the people attackers are most likely to target.

Cybercriminals don't choose victims randomly.

Executives, finance employees, HR, IT administrators, and anyone with access to payroll, employee data, banking information, confidential business information, or wire-transfer authority deserve additional safeguards.

Those safeguards might include stronger authentication, transaction verification procedures, tighter access controls, additional training, and alerts for unusual login behavior.

Your CFO should not be able to change a vendor's bank account based solely on an email. Neither should anyone else.

8. Have a plan for the click that gets through anyway.

Because eventually somebody will click something.

Your cybersecurity plan should assume that prevention will sometimes fail.

Know who gets called. Know how accounts get locked. Know who contacts your cyber insurer. Know how you preserve logs and evidence. Know when outside forensic counsel or cybersecurity professionals get involved. Know whether legal or regulatory notification obligations might be triggered.

And practice the plan before you need it.

Cybersecurity isn't just an IT problem. It's an HR problem, a training problem, a risk-management problem, a legal problem, and ultimately a business problem.

Manchester City reportedly spent years and enormous resources fighting over what Rui Pinto found after one employee clicked one link.

Your company probably doesn't have Manchester City's resources.

Train your employees accordingly.

A firefighter with PTSD asks to bring his dog to work as a reasonable accommodation. The dog helps calm him. His psychologist supports the request.

Does the ADA require the employer to say yes?

Not necessarily.

In Fisher v. City of Lansing, a firefighter claimed that the city violated the ADA when it refused to let him bring his dog, Chet, to the fire station. Fisher had PTSD, and his psychologist recommended an emotional support animal to help manage his symptoms at work.

The court sided with the city.

The problem wasn't whether Fisher had a disability. It was whether the dog was necessary as a reasonable accommodation. To prevail on an ADA failure-to-accommodate claim, an employee must show that the requested accommodation is both reasonable and necessary — that it addresses an obstacle preventing the employee from performing an essential job function.

Fisher couldn't make that showing.

He admitted that he could perform his job without the dog. "Not well," as he put it, but he could perform it. His psychologist likewise couldn't identify any particular job duty Fisher could not perform without the animal. Instead, the doctor testified that the dog had a calming effect on him.

That's where the distinction between a service animal and an emotional support animal becomes important.

Under the ADA regulations governing public entities and public accommodations, a service animal is a dog individually trained to perform work or tasks directly related to someone's disability. Emotional support, comfort, companionship, and a calming presence, standing alone, don't qualify.

But employers need to be careful with that distinction.

Those definitions come from Titles II and III of the ADA. Title I (the part of the ADA governing employment) doesn't contain the same service-animal definition or automatically exclude emotional-support animals from consideration. The Job Accommodation Network therefore recommends that employers treat requests for both service animals and ESAs like other reasonable-accommodation requests: engage in the interactive process and determine whether the animal is needed because of the employee's disability.

In other words: "It's an ESA, not a service dog" should not end the conversation.

For employers, the better approach is:

1. Start the interactive process. Don't get hung up on labels.

2. Ask what limitation the animal addresses and how it helps the employee perform the job or access an equal workplace benefit.

3. Request appropriate medical documentation when the disability or need isn't obvious.

4. Focus on necessity, not preference. "This helps me" isn't necessarily the same as "I need this because of my disability."

5. Consider the actual workplace. Safety, sanitation, allergies, disruption, animal control, and essential job duties all matter.

6. Document the analysis. A categorical "no animals" rule is much harder to defend than an individualized ADA assessment.

The ADA doesn't require employers to turn every workplace into a dog- or peacock-friendly office.

But it does require them to treat "Can I bring my dog to work?" as an accommodation question, not merely a pet-policy question. 

Nineteen years in, I repainted the walls. Your handbook needs the same.

Your brain is built to notice what's new. That's not a flaw. It's a feature.

Novelty grabs attention and makes people curious. Wharton researchers Hengchen Dai, Katherine Milkman, and Jason Riis describe a "fresh start effect": people are more motivated to act after a clean break, like a new year, a birthday, or a Monday.

The Ohio Employer Law Blog is 19 years old. I built this website in 2007, and it looked like it.

This week, it got a new look. Same content and same opinions, just easier to navigate with better mobile responsiveness. 

Your handbook has the same problem. It hasn't been refreshed in years. Nobody notices it anymore. It's faded paint. Your employees walk past it every day without seeing it. And that faded paint has a cost.

1. Employees stop reading it. A policy no one reads is a policy no one follows.

2. Managers stop enforcing it. The handbook says one thing. The practice says another. A policy you don't follow can become evidence of pretext. Plaintiffs' lawyers love that gap. It's their Exhibit A.

3. The law moves on without it. Remote work. The Pregnant Workers Fairness Act. AI. If your handbook still reads like 2015, it's missing today's rules and today's risks.

4. Patching piles up contradictions. Add-on memos and one-off updates collide with each other. A clean rewrite lets you cut what you don't follow and clarify what you do.

Pick a policy at random.

Can your managers explain it without opening the handbook?
Does your team follow it exactly as written?
Is it current with the law?

If you hesitated on any of them, you have your answer.

A rewrite is a fresh start. Use it. Retrain your workforce. Coach your managers on enforcement. Get new acknowledgments signed. Apply a fresh coat of paint.

If you're ready to repaint your handbook, email me, or contact the Employment & Labor team at Wickens Herzer Panza.

---

Here's what I read this week that you should read, too.

Wouldn't It Be Nice — via The Norah and Dad Show Podcast

Why Your Employees Override AI — via Harvard Business Review 

When Employees Fear AI Losing Control, HR Needs a Better Answer  — via EntertainHR

Meta employees ordered 'attorney/client privilege' hats while fighting child safety disclosures — via The Verge

Off the Clock, Beyond the Test: Cannabis Use and Workplace Impairment in New York — via The L•E•Jer

AI, And Experts, And Hallucinations, Oh My! — via Above the Law

The Most Dangerous Thing a New Manager Can Say Is 'I'll Fix This' — via Improve Your HR by Suzanne Lucas, the Evil HR Lady

Ways to remove barriers to hiring people with disabilities — via TLNT

The cup meltdown, the "Lost" finale, and other tantrums you've witnessed at work — via Ask a Manager

NLRB Restores Employer-Friendly Standard for Workplace Outbursts During Protected Activity — via Employment Law Letter

'I felt shame': former BA worker locked in legal battle after losing job of 30 years — via The Guardian

"Not Crazy About White People" Allegedly Appeared in an HR Report. What Could Possibly Go Wrong? — via Eric Meyer's Employer Handbook Blog

A New Era of Health Care Noncompetes: Emerging Models and the Future of Labor Mobility — via Trading Secrets

The doctor's note is vague. What should the employer do next? — via HR Dive

Peter Gabriel Reveals Full Details, Release Date for New Album o/i — via Consequence

That's the 6th Circuit, in a retaliation case that started with a groping complaint and ended with a pornographic slideshow.

Gertrude Crisp, an EMT at the Scioto Ambulance District, had her own take on the place. "[T]he inmates run[] the insane asylum."

Crisp met co-worker Joshua Gullett in 2012, when both worked at the Portsmouth Ambulance Department. She says he commented constantly on her body, asked to see her breasts, and "jokingly" touched her even after she said no. Same for any woman who gave him attention.

Around then, another EMT showed Crisp and others naked photos of Gullett, allegedly from an adult website called Fetlife.

Both Crisp and Gullett later landed at Scioto. In December 2018, Crisp says that while on shift together, Gullett talked about her body, tipped over the recliner she was sitting in, and tried to stuff her into a trash can. She also claimed that he told her they were alone and nobody would hear her scream as he touched her breasts.

That same night, Crisp reported Gullett's actions to her supervisor. In response, the employer made sure the two never worked the same shift. Gullett faced no other consequences. Crisp figured complaining more was futile. She filed no legal claim. She did tell anyone who would listen that he was "a predator."

Four(!) years later, Crisp sat down at work with two new EMTs to talk about "EMS culture." She warned them about predatory men in EMS. Then she showed them nude images of Gullett and his wife, who by then was also a Scioto EMT.

Scioto's board investigated and unanimously fired Crisp for showing nude pictures of a co-worker to other employees while on duty. The board member who led the investigation called it "way over the top." The pictures weren't necessary to warn anyone about Gullett, he said, and they could have made everyone uncomfortable.

Crisp sued for retaliation under Title VII. She lost.

Warning co-workers about harassment is protected activity. So may be sharing explicit material with HR when it's necessary to support a harassment claim. The court acknowledged as much. But in this case, the photos weren't necessary to make her point, and the wife had nothing to do with the alleged workplace misconduct. An employee who mixes protected and unprotected conduct can't use the first as a shield for the second.

Crisp's complaint was protected. Her misconduct in showing the photos wasn't. Your job as an employer is to understand the difference before you fire or otherwise take an adverse action against anyone.

Bostock says what it says. LGBTQ+ discrimination is sex discrimination under Title VII. Period.

A federal judge in Atlanta, however, just read it to say something else.

Tara Kulwicki is a lesbian who wants a child. Her employer's health plan covers female infertility treatment. But to get it, a woman has to prove infertility—by having procreative sex for months without conceiving, or by paying for failed rounds of artificial insemination.

Straight women get the free option. Kulwicki has to pay.

So she sued her employers, Cobb Hospital and Wellstar Health System, claiming it's sex discrimination to make her pay out of pocket to qualify for the same fertility benefits straight women can reach by having sex with men. The court dismissed her claim, and had to do some mental gymnastics with Title VII and Bostock to get there.

Let's start with what the court got right. Bostock didn't make sexual orientation a protected trait separate from sex. It gets "swept in" through the but-for test applied to sex. In other words, change the gay woman's sex and she becomes a straight man whose attraction to women the employer tolerates. If the employer treats the gay woman differently, it's because of sex.

The court even concedes the point in a footnote. Flip Kulwicki's sex while holding her attraction to women constant, and she switches from homosexual to heterosexual. A "nominal quirk" of the Bostock test, the court wrote.

Except it's not a quirk. It's the whole point of the Bostock holding.

The court tried to use that same logic to dismiss Kulwicki's claim. Flip her sex, and a male Kulwicki gets no infertility coverage at all, because the plan only covers women. Give him a wife but keep him unable to conceive through intercourse, and he pays for insemination just like she does. Her problem, the court said, is a trait "not unique to women or lesbians."

But her inability isn't a bad knee. It exists because she's a woman attracted to women, so the plan's free option—sex with a man—isn't open to her. That's exactly the discrimination Bostock forbids.

If discrimination against LGBTQ+ employees is sex discrimination, this case was wrongly decided. Not partly. Entirely. Bostock says what it says. It doesn't come with an asterisk, and the Kulwicki court should not have applied one.

Man City's 35 counts, and why the cover-up is always worse than the crime Harassment prevention can't stop at the boardroom WIRTW #811 (the 'uni' edition) Can HR listen in on an employee's doctor's appointment? Catching the thief red-handed isn't enough to win a trade secrets case