[Moved to [email protected], check pinned post.] iiiiiiitttttttttttt.

“Here’s an offer for something we know you want and that a respectful employer would provide. Oh, you actually thought your employer respected you? You must be an idiot who needs special training.”

The only phishing e-mails I receive are from my employer. As a matter of process I report these e-mails like a diligent lackey, then upon receiving an e-mail congratulating me on passing their test, I report that one too. I think the non-test phishing reports undergo manual review so I hope I'm wasting someone's time somewhere in payback.

Still haven't forgiven them for a tone-deaf 'we care about you during COVID' phishing e-mail they sent when everyone was genuinely struggling.

Companies will do that and then send links with url shorteners for totally legit things and wonder why everyone ignores then.

Sounds about right.

Pro tip, set up a rule in your email client to send any email that contains the following phrases, phishme.com or knowb4, in the header to junk.

Note that I said header, not From field.
It is so stupid that orgs spend thousands of dollars on these products and you can be seen as not being a phishing risk because of their shitty systems.

At my work, we got a phishing email a few weeks before Christmas.

It was for a gift card for a Honey Baked ham.

I was pretty sure it was a phishing test but apparently a lot of people fell for it. Enough so, that a fairly senior colleague blasted an email saying it was in poor taste since it was Christmas and a lot of people could really use it.

I thought that made it more effective training because a scammer would use that, but I also understand that it has the potential to fuck with people's emotions.

Anyway, that started a trend within the company's Teams and social platform, making jokes and sharing memes.

The CEO even emailed, agreeing with the original email blast and then had a real giveaway of honey baked gift cards.

I got a message saying I needed to sign up and completed a course I'd never heard of so I marked it as spam and deleted it.

Turned out it was genuine...

I just don't open emails from my company unless the subject has the words Urgent or Action Required and even those I forward to the IT anti phishing email to annoy them, even when I know it's legit.

In the last two months I have gotten about a dozen emails on my work account that tripped enough red flags for me to think they were phishing attempts. It turns out that they were all legit and failure to respond could be determental to still working there. Good thing our boss was looking out for us.

What I have learned is that I should respond to any half-assed email and ignore the years of annual training I've recieved to the contrary.

My company sent one of these out made to look like a survey on employee thoughts and opinions on their compensation - a very real issue in our company that I suspect they just wanted to try and condition people not to talk about.

Replied back to let them know as such and to inform them it was an asshole move and I would not be completing their training. Was worth the HR write-up - fuck those suits, too.

I'm on our cybersecurity team and our last phishing sim was so real looking and legit sounding I thought it was real, and I knew the phish was coming. The only indicator was the sender email was a slight misspelling of Microsoft. I pointed out that that phish is not a fair phish, our users are not going to meticulously examine every email for microscopic indicators. Half if them are barely tech literate, but they're doctors or nurses and only know what they need to know to do their job. Our cybersecurity lead was completely in "wtf are you talking about? From Micrasoft.com is totally illegitimate" mode, I had to point out that our users flag 70% of the emails as phish, and phishing tests that look like completely legitimate emails aside from a single character out of place in an obscure location most of our users aren't even thinking if looking at undermine legitimate emails and increase our workload b/c we've trained our users to think every email is a phish test from cybersecuriry.

Corporate does this all the time to at my work.

The GM of my office came talk to me because I had actually won like employee of the quarter or something, but when I got the email with the "redeem here for your $50 gift card" I reported it as phishing. I asked him why they couldn't just go to the grocery store and hand me a physical gift card, he blinked for a moment like that hadn't occurred to him. I showed him the quarantined emails I get on Outlook every day from dozens of phishing attempts made to my work email everyday.

They do this at my work. I simply report every external email I get as a phishing attempt.

As a result, I've caught all the fake phishing emails sent by our IT department, at the minor cost of them having to clear 50+ legit emails per day. My coworkers have been quite appreciative of my tactics against phishing, and have started to adopt my methods.

Strangely enough, the number of phishing tests IT has sent out has dramatically decreased since I was initially hired.

Sounds like phishing tests are just the company outsourcing spam filtering to their own employees instead of paying for a spam filtering service of their own.

Companies are damned if they do and damned if they don't. All the best security on the world will never prevent an attack from the universally weakest link - humans.

Best you can do is identify the humans that are likely to fall for it and remind them to be extra careful when clicking links in emails.

We also have anti fishing campaigns in our company and usually I do pretty well with those, but last year because of a running event they sent a mail out in regards to free T-shirts for the event. Most of the company including me failed gloriously.

Lol that person is stupid. these test phishing mails are super easy to spot. I hope they don't work in tech

You guys read your emails?

You can tell it's fake because it suggests that corporate would just hand you a new benefit out of the blue.

This likely had several warning signs that can be used for even personal emails. 1) is it too good to be true? Definitely in this example. Give me a gas card physically and I might believe it. 2) look at the actual link before you click. If it's not part of the main domain for the company you're expecting, or not within the intranet at work, it's an automatic nope. 3) any oddities in the message or images that seem wrong. Misspellings, pixelated logos, etc. This is the smallest red flag, as often times getting a perfect email without any grammar or spelling issues means it didn't come from a manager, that seems to be a requirement.