To have reported this in work today?

[Sunshineforeverandever]

I work in a press office. Someone (claiming to be a journalist, I can’t verify that he was) called us this morning with a media enquiry, he provided me with a booking reference for the customer that his article was going to be about. I spent a large part of the day diligently investigating his media enquiry and it turns out the booking reference he gave me doesn’t exist on any of our internal systems and we had no record of the customer (he gave us their name) being involved with our company either. I decided to pass this to our legal team to investigate as I don’t think he was contacting us in good faith. My colleague (junior to me) says I overreacted by passing this to legal to look into to. Was I being unreasonable? I’m almost certain his enquiry wasn’t genuine (a few more reasons why but can’t go into them on here).

Sorry if I’m being vague, I can’t really go into detail on here so trying to keep it less identifying

Honestly, I don't know what you expect anyone on here to be able to tell you, surely it depends completely on what your company policy is?

I don’t know much about your industry. Was the enquiry about personal details of a person/thing that are not otherwise public knowledge? If so it sounds like you absolutely did the right thing in not divulging this information if you cannot trust the source of the enquiry.

I'm in a security aware industry and I would absolutely have reported.

We have reported similar concerns in the past. Better to be safe.

In my company you'd be in trouble for not reporting, particularly if you have out any sensitive info.

He was planning to write a story about a customer’s negative experience with our business. But we couldn’t verify that this customer (if the customer even does exist) he was talking to actually had a booking with our company

It's often better to check this sort of thing than get caught out when it's published!

If in doubt, report it. The legal team will decide whether it's something they ought to pursue 🤷

No, you did the right thing. Its better to be too careful than risk letting information out to the wrong person.

There was no sensitive info given out and he didn’t ask for any. He just asked for a statement on the “customers” experience

He was claiming to be from a news publication but was contacting us from a personal email so I do plan to reach out to the publication he was claiming to be from to see if I can verify him. If I verify him then it means there’s someone out there telling journalists they’ve had a negative experience as a customer of us when they haven’t

My colleague said i overreacted as it was probably just a “prank”!!

Yanbu. The guidance you should always follow in this situation is follow your instinct and better to over-report than under-report. You should also keep line management or senior management informed.

All sorts of phishing activities exist and the contact could have been part of an attempt to elicit information that the external person should not have access to.

Why on Earth did you not start off by checking the "booking number"?

And, what the heck can the "legal team" do, lol.

He wouldn’t give me the booking reference when he first called. He said he would have to ask the customer for it. Then he rang me back with it and then I looked into it and then found that the reference doesn’t exist at our end

What exactly are you expecting legal to do here? Sounds like someone wasted your time and gave you the runaround. Which is frustrating. But not something I would expect a legal team to look into unless there is more that you haven’t told us.

I think I’d have just replied to him saying that you couldn’t help because the booking ref didn’t exist on your system.

When I contacted him back to say the booking reference didn’t exist, he said he published the story an hour ago so that’s another reason why I contacted legal

I think it's fine. Even if they just keep it for info. If anything else happens related to this/ the person speaks to someone else at or about your company it helps to build a picture of what's going on. If the legal team don't think it warrants investigating further then they won't.

When I contacted him back to say the booking reference didn’t exist, he said he published the story an hour ago so that’s another reason why I contacted legal

You could have mentioned that bit in your OP.

Did you tell your boss?

If it's the policy to report suspicious inquiries to Legal and this felt suspicious to you, then you were right to report it. Legal will know whether to investigate it further; perhaps it's not of immediate concern but best to be aware in case it happens again/to someone else in PR. You'd be wasting a lot more time if you didn't report something that turned out to be a problem. If in doubt, though, I'd check with your boss rather than a junior colleague (or MN!)

Your company should have a policy for media requests and if they don’t then it’s to your manager, or someone else appropriate. Sounds like you did the right thing!

I think what you did was fine, we discuss things internally all the time. It is better for people to be aware.

I would ignore your junior colleague, what do they know anyway - do they have special knowledge/experience?

I am in the same industry as you. I would possibly log as an adverse incident but would be unlikely to report to legal unless that's company policy.

I would presume the journalist was a freelancer (hence email address).

have you reported yourself for a gdpr breech?

There’s nothing in company policy about reporting it to legal. I am the head of the department but unfortunately don’t have authority to change our policies. Right from the moment he first contacted me it felt odd, unlike any media enquiry I have dealt with ever, it just felt odd. I can’t put my finger on why it felt odd but it just did