Phishing emails sometimes pretend to come from Personio. This is a type of email scam where someone impersonates a trusted organization to steal your personal information. This article explains how to verify if an email you received is a genuine Personio email.

Check the sender's full email address

Most email clients only show a display name, not the full address. Click the sender's name to see the full email address. Most modern email clients, like Gmail and Outlook, also show a verified sender indicator when an email passes automatic checks. If you don't see this indicator, it's worth noting as a possible sign of phishing.

Genuine Personio emails come from one of these addresses:

• personio.com
• personio.de
• m.personio.com
• mailjet.com

Mailjet is the external email provider Personio uses to send system alerts, so emails from this domain are genuine.

If the address doesn't match one of these, treat the email with caution. Don't click any links, open attachments, or reply with personal information.

Look for signs of phishing

Phishing emails often share a few common signs. Watch for these:

• Requests for your password, multi-factor authentication (MFA) code, or payment details. Personio never asks for this information by email, no matter how convincing it looks.
• Urgent language that pressures you to act immediately, like a threat to suspend your account.
• Links that don't lead to personio.com or personio.de. Hover over a link before you click it to see where it leads.
• Requests to download and run a file.
• Sender addresses that look similar to Personio's but aren't exact, like personio-security.com, personi0.com, or personio.net. This is called typosquatting.

Understand automatic email checks

Your email provider, like Gmail or Outlook, checks every incoming email automatically. It uses Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC). These tools confirm the email really comes from the domain it claims. You don't need to set up or configure anything. Your provider runs these checks for you.

All Personio domains pass these checks. An email claiming to be from Personio might go to your spam folder or show a warning banner. It could also end up in quarantine. Treat any of these as a sign of spoofing.

If you want to check this yourself, open the email's original source:

1. If you use Gmail, select "Show original". If you use Outlook, select "View message source".
2. Look for the Authentication-Results line. If it shows spf=pass, dkim=pass, and dmarc=pass for personio.com or personio.de, the email passed these checks. Any fail result means a scammer spoofed the email.

Note:
If you suspect an email is phishing, don't interact with it. Forward it to reportphishing@personio.com, then delete it.