Several employees received a fraudulent text message from someone claiming to be the Chief Executive Officer (CEO). The message stated: “I’m in an airport right now with no access to email. I need you to buy gift cards for employee recognition awards. Please send the gift cards to following email address.” Which of the following are the best responses to this situation? (Choose two).

The fraudulent text message is an example of smishing, a type of phishing attack conducted via SMS. Issuing a general email warning to the company immediately alerts employees to the ongoing threat and provides guidance on how to identify and report such scams, preventing further compromise. Adding a smishing exercise to annual training proactively educates employees on recognizing and responding to these attacks, strengthening the organization's overall security posture. Canceling existing gift cards is unnecessary as the scam targets new purchases, not existing ones. The CEO's phone number is likely spoofed, so changing it won't prevent future attacks. A forensic investigation on the CEO's phone is not immediately relevant as the CEO is the impersonated victim, not the source of the attack. Implementing Mobile Device Management (MDM) is a broader security control that doesn't directly address the immediate threat of social engineering via smishing.