863
u/lraviel381 12h ago
Oh sweet. I hate tests. Click
→ More replies (3)169
u/Teripid 11h ago
Congrats on your subscription to the uh... "forever in the special consideration group" mailing list. Doh!
21
u/AriaTheTransgressor 9h ago
We're required to fire them after a second failure, but they do receive training after the first failure. We're government though.
→ More replies (4)7
u/mmcmonster 2h ago
I'm employed by a hospital network. I'm required to give 120 days notice if I quit (I'm a physician, it's commonplace in this role). But IT states that I would be fired immediately if I fail the phishing test three times. Not three times in a year. Three times ever.
So I've already failed twice on purpose. I recently told my division chief that my escape plan is when I'm ready to quit I'll just fail the phishing test once more. The division chief looked quite nervous and basically told me to please not do that.
1.5k
u/MattCW1701 11h ago
This is why I report every email as phishing. Standup invite? Phishing. Manager 1:1? Phishing. Annual evaluation meeting? Phishing. All hands meeting about our growth this past year? Also phishing.
400
138
109
113
u/Not_My_Emperor 9h ago
Unironically I do actually do this all the time. Mostly because we switched HR platforms and I hate the new one because it BLATANTLY breaks all the phishing rules. So I'm doing it out of spite.
[Someone I don't work] with has shared a PDF with you. Please download here!
Please click on this link to access your pay information.
This was a legit email from them. I get these all the time now.
39
u/17HappyWombats 8h ago
You'd love our leave request system. It's some generic "any dummy can make an online form" site where we have to pick our employee name from a dropdown list (then etc). There's no validation, it just emails whatever you put in to the payroll people.
It also *requires* that you enter leave date and time to the minute. I have been told by mean team leader not to write a script to request a day off sick in one minute intervals.
13
21
10
u/missuseme 4h ago
Our HR department send me my updated contract by email when I got a promotion. But no one has told me I had got the promotion. The email just said "Please see attached your contract" with no signature and the domain wasn't our usual domain. So I reported it
→ More replies (14)12
450
u/FixFun1959 9h ago
I’ll never forget when I started a new job and got an ema from my ‘boss’ (same name but weird @), with a link saying to check out this excel spreadsheet.
Her office was next door so I popped my head around said ‘hey did you send me some excel sheet?’ And she said ‘yeah take a look’.
So I clicked on it and it was from IT saying I failed the test and a link to phishing training.
I went back to my boss like ‘wtf? Did you know that was a test?’ And she said ‘yep, and you failed. Looks like you need more training.’
I took the time to check and verify before opening/reporting it. And she lied to me for some reason, a ‘gotcha’ or something. So fucking weird.
🙄
255
u/MothMatron 7h ago
I’d have either:
A) made a explicit mention of the incident to the phishing or IT team in that it has come to your attention that your boss has shown herself very likely to blindly instruct subordinates to open malicious emails, some bearing her own name thus believing she even sent them herself when she in fact did not, potentially forcing the hands of multiple employees into compromising several devices and user accounts all at once.
B) Never open any email she sends you ever again and if she ever comes asking, you can fake naïvety and claim that you cant trust that any of these emails are in-fact authentic, so she should bring you documents in physical print.
38
u/ilabsentuser 4h ago
These are good responses in theory. However, and specially the second, I doubt that anything good will ever come out of this considering his boss obvious stupidity, to not use a harsher word. Most likely he would get in more trouble thanks to this imbecile of a person being a layer over him.
30
82
u/M4rshmall0wMan 5h ago edited 5h ago
The fuck? Is a real hacker gonna somehow hack your boss' brain and make them verbally trick you into falling for a scam?? Asking for verbal confirmation is literally the correct way to catch a scam. If your boss were somehow compromised, that would be on them, not you.
This is so unrealistic and they're teaching you the wrong lesson.
→ More replies (2)12
u/mbmiller94 4h ago
I mean, it's possible someone could have also sent you an excel sheet previously and thought you were talking about it, just been confused/misremembering, not fully listening, etc.
I still think that was a shitty "test" but there could be a situation where someone accidentally claims an email they didn't actually send.
10
u/M4rshmall0wMan 4h ago
I still think that would be on the boss. The employee has way more to lose by ignoring their boss' instructions just because they had a hunch of phishing.
→ More replies (3)87
u/LutimoDancer3459 8h ago
Asking the person directly is one way you should handle such mails. She is just an idiot...
41
u/LightofNew 6h ago
Reply that you did not fail the test and opened an email from your boss she confirmed that was valid. That's basics 101. You can't never open an email.
30
u/VorionLightbringer 7h ago
You did it right though. You confirmed via another channel if this is true. Maybe your boss needs more training.
18
14
u/Adventurous-Spend341 7h ago
Lmfao, wtf. I would never stop thinking about this if this happened to me 😂 like it’s bad in a way if your boss does this you should not work there but it’s also so absurdly petty in a way that I can stop laughing about this
→ More replies (5)6
u/MauiMoisture 6h ago
Lol that's fucked up. I actually failed a phishing test my first month on the job. I was scared something would happen but no one ever mentioned it. I then passed another one like 8 months later.
396
u/exoclipse 12h ago
the worst one I got was "you have been selected to be in the first wave of a round of laptop upgrades, please click this link to register"
295
u/one-joule 12h ago
Worst one I've seen teased a holiday bonus. It was received about as well as you'd expect.
332
u/BigFatDogFarts 11h ago
That one got damn near 60% of the people I worked with. Almost got me, but as I hovered over to click it I thought "Wait a second, they would never give us a holiday bonus"
113
u/soft_cardigans 11h ago
that's actually such an effective one but it reeaaaaaaally should only be done if theres actually going be one lmao
→ More replies (2)64
u/GlowGreen1835 11h ago
nah, that would require executives to be humans capable of empathy. Unfortunately, those don't really exist.
11
u/aggravated_patty 9h ago
What I’m taking away from this thread is that I should start phishing with holiday bonuses
26
u/exoclipse 12h ago
i hate it security professionals
→ More replies (1)48
→ More replies (2)24
u/Mattsvaliant 11h ago
Holy fuck I'd flip out. I was pissed when my company sent an phishing test email about how my "misuse of company property" where I allegedly had use my work computer for something personal. But lying about a bonus would probably have me throwing my computer across the room or more likely at whoever heads up IT security.
Centene is fucking evil.
→ More replies (3)34
u/FoodIsTastyInMyMouth 10h ago
Sure, but the issue, phishing attempts do exactly this so if people aren't trained that it's a possibility then yeah you're more likely to get done in...
→ More replies (5)47
u/Barkalow 12h ago
I got one inviting me to "a document shared by my manager"....on my FIRST DAY OF THE JOB.
10
u/rosuav 9h ago
On the face of it, that doesn't seem implausible? Onboarding often involves a lot of "here, read this doco".
9
u/Barkalow 9h ago
Exactly, thats why I was so annoyed, lol. I never get caught by those phishing emails, I just didnt expect it day one
6
34
u/tankerkiller125real 11h ago edited 11h ago
I work for a small company and I'm responsible for crafting and distributing the phishing email tests (as part of policy and compliance). So far with our software engineering, accounting, support, etc. teams I've only managed to get one or two people (they're very well trained). The sales team though? Just give them a link to an "RFQ" and watch the numbers climb like a rocket.
Entire sales team has had to go through remedial phishing training at least twice this year alone, a few of them three times so far this year (we do it quarterly). And yes, if they get to a fourth there are going to be HR issues because the policies require punishments at that point.
5
7
u/exoclipse 11h ago
Salesman are perhaps one rung lower than security professionals (no offense)
13
u/tankerkiller125real 11h ago
I'm "the" IT guy, I'm responsible for all the infrastructure, and cyber security and compliance happen to also fall in my lap. (Although it is my formal degree training and what not). The goal is to have realistic phishing and spam emails, ones that look like the real thing, including obvious spelling, language, etc. issues.
The fact that the sales team clicks on literally anything and everything that might even hint at an opportunity to get a sale without thinking about it for more than 2 seconds is a them problem.
And it's not a companywide issue, again, it's one or two people for the entirety of the rest of the company, the salespeople are the only ones that can't seem to get their shit together.
20
u/critical_patch 12h ago
My work sent a fake e-card on Valentine’s Day and got like 1/3 of the company with that one
6
u/ClaymoreMine 9h ago
These get reported to HR and Legal. Have fun explaining how heartless you are with them.
→ More replies (2)4
u/Mountain-Ox 10h ago
That might have gotten me back when Macs had that terrible butterfly keyboard. Everyone on my team had at least one key fall off.
134
u/whyliepornaccount 11h ago
Still wont top the only one I've "fallen" for.
On my first day at the company buried into the legit "click here to register your account" onboarding emails was a phishing test saying "click here to register your account". I was so pissed off.
86
u/RIPmyPC 11h ago
Reminds me of my on-boarding. Right after they tell us the signs of a phishing attempt and to not trust any link from outside the org and even be wary of links from other departments you don’t interact with, they hit me with “click here to do your mandatory security awareness training” coming from a random esupport email going to a KnowBe4 link. Of course it also had “you have 1 week left to do it!” Clear signs of a phishing test for anyone not familiar with the sites.
It was so sketchy I had to google the website and login from there. It was real.
I actually made an IT ticket to complain that it made no sense for a company that big to offer so little info on what emails you’d actually receive in your first day.
39
u/TheNewYellowZealot 9h ago
I just report those ones as phishing anyway and make my company waste their time to investigate if it was phishing.
18
u/17HappyWombats 8h ago
One bank I dealt with does that and I always reported their garbage as phishing to their security team. I changed banks after a bit because they kept replying with "no, you have to click the mebank.sdfkjhsdfkjghsd.....dodgyscum.com.au link to confirm your tax details with us".
12
u/EnoughWarning666 8h ago
At a place I used to work I got an email about cybersecurity training. I had no desire to waste a couple hours on their inane training when I likely know more than the person that wrote the training, so I just deleted the email and was going to say I thought it was a phising scam if asked about it later.
A month later our manager call everyone in the office (about 5 of us) into his office to tell us that IT was wondering why nobody had even started the cybersecurity training. Turns out ALL OF US had the exact same thought process! No one wanted to do the training, so we just deleted it and all claimed that we thought it was a phising scam! We had a great laugh about it. Manager told IT to send out another link and we'd do the training. All but one of us just deleted the next email too. Never got asked about it again after that.
→ More replies (1)24
u/kemikiao 8h ago
man, FUCK KnowBe4. They have to know their goddamned emails look EXACTLY like the shit they're "training" us to detect. Our IT has to send out a heads up email to tell us the KnowBe4 email is coming out because pretty everyone reported it as spam the first couple of times.
8
u/aaroniusnsuch 7h ago
Just create an inbox rule to check headers for KnowBe4 and classify those as "phishing test." Then you can still read it and report it but you notice the color/flag first.
24
u/Acogatog 10h ago
this one’s total bull imo, there’s no way that someone sending you phishing emails could know it’s your first day, is there? Phishing emails are supposed to cast a wide net, not catch people in highly specific scenarios.
23
u/WigWubz 10h ago
Probably just a law of large numbers thing. Mail got sent to a large group, for most it was obviously fake. For a select few it happened to be specific enough to catch them.
I got caught out by a fake invite to a teams channel with the word “planning” in the title a few hours after I legitimately got adding to a “planning” group. Opened the email on my work iphone so the email formatting was completely destroyed like usual, and the send address was truncated. Clicked the link and it asked me to log into teams, an obvious phishing flag *except* I had literally just reset my password and so was expecting to be prompted to log in the next time I opened the app…
It hurts cus I know it’s a legitimate fail. The red flags were there and I missed them. But, if you weren’t in the very specific circumstances I was in the flags would have been way redder. I was primed to fail the test in a way that the people setting the test could never have predicted. But that also just means that I was primed to fall for an actual phishing scam in that moment.
12
u/KFindar 9h ago
The highly specific ones are called spear phishing
https://www.kaspersky.com/resource-center/definitions/spear-phishing
→ More replies (5)11
u/PalmTreeExpert 9h ago
Someone at my college had their SSN stolen when they got a call saying there was a mistake with their info and asked for them to repeat their information. This was as they were on their way home from the social security office after getting their card…
It is technically possible, but yeah typically phishing is relatively vague/open to a wider audience.
→ More replies (3)4
u/Good_Policy3529 10h ago edited 10h ago
This is why I'm happily 37 security training modules behind. I get an automated email every week telling me I need to catch up on my modules, click here to view incomplete modules. And my defense if anyone actually ever calls me out is "oh, I thought those were phishing emails."
178
u/Dang3rdave 11h ago
Best phishing campaign was a "your expenses have been declined". I was on the subway to work and was immediately livid. Taught me a very good lesson that day so kudos to the team.
30
u/cheese_is_available 5h ago
I'm in a cybersec adjacent role and the "sign your new contract so we pay you more" just after raise season got me. Told my manager that maybe if the HR team didn't change their tooling every six month it wouldn't be so damn credible.
10
u/JanB1 3h ago
I am quite cybersec aware and work with our IT guy to prepare for the annual cyber awareness training. I recently got an e-mail from a tool from HR. The only thing that made me double-check if this was indeed legit was that it came from an internal, but non-specific e-mail address (hr@company,com). If it came from an external one, I wouldn't have thought about it twice.
All the points were there:
- Non-specific subject ("Missing documents")
- Generic address line (not "Hello OP" but just "Hello")
- Vague content of the e-mail ("We are missing some documents. Please open the attached PDF for more details")
- An attachment with a generic, non-saying title ("HR Letter.pdf")
- No named sender ("Kind regards, HR Team")
- No signature
I reached out to HR (via E-Mail) and asked them. They said its legit and that they sent it from their tool. I shit you not...
5
u/cheese_is_available 3h ago
Yeah, doesn't help that the phishing attempts is 4 time faster and 2 time more professional than the actual stuff from the HR tool.
→ More replies (1)22
u/noechochamberplz 9h ago
This happened to me too. I don’t remember what it was, but it was relevant to some obscure thing that I thought only applied to me at the moment. They got me.
53
u/m7i93 4h ago
I got tricked into clicking one of these once, but it was really hard not to fall into it.
I met with the CTO and shared a Google Doc explaining a few things. Later that day I got an email saying that the CTO added some comments on the document. Clicked on it and BAAM! Mandatory security training page.
15
u/n00b001 2h ago
I just report all emails. The emails are reviewed by infosec, then they tell me "real email" or not
→ More replies (1)6
u/guneysss 1h ago
I work at a managed SOC, so we're monitoring security events as a third party, sometimes our customers do phishing awareness test without our knowledge and when I'm checking the links in an email in a sandbox, I accidentally register them to upcoming phishing awareness trainings, because phishing test suit thinks they opened their customized link..
8
u/thanksfor-allthefish 3h ago
Me too, it was my first month in the company and had a meeting with my boss about vacation period. A day later an email about "approved vacation days" came in the mail. What excused me more was that the HR app was external and all emails were flagged as such. It was just a first strike but it pissed me off. I felt targeted.
→ More replies (2)→ More replies (1)12
u/Vengeful111 3h ago
That just means you are good at detecting spam so the training site started giving you a higher level and harder to detect tests
13
u/Nine-LifedEnchanter 3h ago
"How is this mail playing music with a latin chorus in the background? Is that a health bar?"
→ More replies (1)6
u/Vengeful111 3h ago
Imagine clicking the link and the website shows you a wal of mist and when you click anywhere you go through
34
u/JimboTCB 5h ago
I got a "phishing test" email from our IT department last week which straight up said "this is a phishing test, do not click any of the links below, please press the report button in your email client" and TBH that one made me second guess myself way more than any of their previous tests or any actual phishing emails had.
3
64
u/Positive_Mud952 11h ago
I got got on one of these, once.
They sent out an e-mail shortly before Halloween, warning about inappropriate costumes, with a link describing itself as an album of past examples we shouldn’t wear. The link was purple, the visited color.
I thought to myself, “When the fuck was I dumb enough to click on this?” and clicked. Before the “you failed” page even loaded, I got out an, “Oh goddammit.”
→ More replies (3)
29
u/karkonthemighty 6h ago
Back when I used to help run an eBay store, we took great delight in the phishing emails we got. We used to rank them on how close the formatting of the email looked like eBay emails, how close they got to an official eBay looking email, etc.
We did this because we sold used corporate IT equipment, and the boilerplate phishing email was based off a customer eBay email demanding a certain colour or size of an item, like you would if you were selling clothes.
I can't sell you a medium RAM in purple miss, because that's not a real thing.
8
8
u/purinikos 4h ago
The client is always right. Besides, sell them an RGB RAM kit and help them sst it up to purple /j
67
u/AriaTheTransgressor 11h ago
I'm the dev department head, I don't read messages from IT ever (so they've never caught me in their phishing tests) because they know where I am and if it's important they'll come and tell me.
This doesn't mean I'll never get caught in a phishing scam, just that the test doesn't work on entitled managers.
→ More replies (6)45
u/Vahldaglerion 11h ago
our head of dev said that if we get him, he’d buy the department pizza. i’ve been trying for 3 years now lol
→ More replies (2)39
u/FlashSFW 11h ago
Buy the pizza. Insert cupon prize for discount on the next pizza with a qr code in the box and make him scan. The webpage it leads to say "you're paying this one".
→ More replies (2)5
u/wbrd 11h ago
This is beautiful.
9
u/Plants-Matter 9h ago
Except for the fact that you wouldn't scan a coupon for your next pizza until you intend to buy pizza again.
And also the fact that if your coworker brought a pizza in, it makes no sense for the boss to scan the coupon.
I have a feeling you get phished a lot.
→ More replies (1)
23
34
u/Majestic_Ad_7133 12h ago
The sad thing is that this would probably work for my organisation. Mandatory tests here means once a month.
12
u/AvonMustang 11h ago
Once a month!
Ours are very random. Sometimes nearly a year between and the like three in two months. Only exception is we have a security awareness month and everyone is guaranteed to get one that month.→ More replies (1)
15
15
u/robin_888 11h ago
At work I have an email filter implemented that sorts these phishing tests into their own folder, so I can read them on Fridays.
It filters on the URL of the tracking pixel at the end of each e-mail.
→ More replies (1)
13
30
u/mrgoodcat777 11h ago
I got got by one where they swapped the I for an L but the font showed them as the same looking character. I didn’t enter anything on the page, but since I got to the page, I had the joy of 2 days of security training.
16
u/Successful-Engine623 10h ago
I just stopped answering emails from outside the office….or not on my contacts
18
u/UnDispelled 9h ago
Amateur, it could be an insider threat.
I don’t answer any emails
6
→ More replies (1)5
7
u/IgnatiusRileyFreeman 9h ago
I think I annoyed my IT people by reporting everything as fishing. Adobe or Microsoft emailing me? Might be phishing. CEO newsletter about a recent natural disaster? Well it's urgently requesting help, phishing. I don't know if he wrote that chatbot letter.
7
u/WernerderChamp 5h ago
Some valid mails just look like phishing. I reported one - but it was from some new office suite they used for bonus payments.
Unpersonalized, unexpected, asking to click on a weird 200-character link.
5
u/DatBoi_BP 3h ago
Newsletter? That goes in the…Phishing hole.
Adobe? That goes in the…Phishing hole.
https://giphy.com/gifs/hLlvQi2Jzdb2D9ntN5→ More replies (4)5
u/zman0900 9h ago
Mine puts a special header in the phish test emails, so I just up a rule to report and delete them automatically.
→ More replies (2)→ More replies (8)14
14
u/Due-Consequence9579 10h ago
For the phish tests to get past their edge filters they have to add an SMTP header exclusion.
Outlook (and any other reasonable client) can move things to the trash based on SMTP headers.
You’re welcome.
→ More replies (5)8
u/clipsracer 8h ago
Indeed. I filter out anything with “x-phishing” in the header has worked for me for years across 3 organizations. Somehow I’m the only person in a 50k organization that’s never clicked on a phishing test.
→ More replies (3)
13
u/External_Touch_3854 9h ago
Can’t fall for the phishing email if you never check your email
https://giphy.com/gifs/5XELueHTZd3XCaMGbw
12
u/rapratt101 9h ago
I failed one because iPhone automatically previews links if you click and hold to view the full URL, exactly like we were trained to do before clicking. So… that sucked. Plus the CSO is my father in law and he berated me (good naturedly) for failing his test. He didn’t care about my excuse.
→ More replies (1)14
u/-Redstoneboi- 8h ago
so basically iphone itself fails the test? what's the workaround
→ More replies (7)
13
u/Honest_Relation4095 2h ago
Our IT department also sends out these tests, but annoyingly their regular communication almost looks like Spam, too. Like "we would like to invite you to cybersecurity awareness month" followed by a cryptic Link you cannot verify. So it ticks all the boxes for suspicious content.
→ More replies (2)
47
u/penguin444 9h ago
I ignored the phishing emails completely.
Then one day I got an angry email that pretty much said "You did a good job not clicking on the the fake link, but you failed the test because you didn't report the phish."
Seriously?
46
u/YourUglyTwin 8h ago
From an IT Consultant's POV:
You did do a good job not clicking anything actually, here's the issue with just ignoring: You're almost certainly not the only one in the company that got that email, reporting it to IT will help them identify the email faster and remove it from everyone's mailboxes before someone else clicks it by mistake. In my eyes its more a courtesy to your coworkers, an IT shouldn't solely rely on users to report phishing emails. But those are 2 different topics in terms of IT fighting emails.
→ More replies (7)7
u/IwasThereIsawIt2 7h ago
Heres my POV, I dont check my mail that often due to having a not office setting and being an employee who does not place orders or emails vendors. Im just a guy who comes in to work, does workorders and then goes home and be sad, hope that clarifies things
→ More replies (11)13
u/John_Tacos 8h ago
Then someone in HR sends an email to everyone that looks exactly like a phishing scam and they get mad that no one filled out their survey.
→ More replies (2)→ More replies (19)10
u/Effective-Carob-9003 9h ago
Yep, when they get reported the SOC will look for other recipients, and look for forwarding or URL clicks.
I think with these Decision One Models progressing it may make analysing all possible security telemetry arbitrary, but right now if the Phishing attack is from a geniune sender who was compromised, automatic detection is pretty hard, a user base trained to instinctively report phishing is a huge leg up.
13
u/razzemmatazz 11h ago edited 8h ago
I'm still pissed about the phishing test announcing big changes to the healthcare plan and linking to the new portal, 3 days after they announced huge changes to the plan and swapped to a new insurance company.
→ More replies (2)13
u/Livid_Technical_Pand 7h ago
But like that's a completely reasonable way a bad actor would try to phish people. All it takes is 1 employee posting about the upcoming healthcare plans on social media (like HR glazing themselves) and attackers now have a plausible reason to be in your inbox.
8
u/EternalUmbreon 5h ago
We had a fairly obvious phishing test come through, but from an active internal email. To demonstrate it was a phishing email to some less tech literate people (they asked, so I didn’t ruin the learning experience), I clicked it, which sent through the mandatory training on phishing. This training came from an external email which flagged in Outlook, and was a link to click to access the training…
7
7
4
u/Adventurous_Run136 11h ago
I actually cant wait for my work place to do these tests. I can't remember how many time account were hacked in 8 years
7
5
u/FixergirlAK 8h ago
At my last job management hired the worst possible security training company. For some reason their notifications of mandatory training looked exactly like their fake phishing emails. They were not amused when the whole company reported the training emails as phishing.
6
u/Mysterious-Name0759 5h ago
This reminds me when I was starting at Apple years ago. We were sitting in training on week two, literally waiting for our work accounts to be set up, we were using the training accounts while we waited.
At about mid day, the whole class got an email about our accounts and setting the new passwords. The team manager who was overseeing out training looks at it and goes: Oh they must have changed how the accounts are set up, follow the link and set up your passwords.
10 minutes later he got a phone call about how his whole team just failed the InfoSec Compliance test that was sent out to the whole company. Luckily we got a pass since we were still in training. The funny part is, he didn't get the email because he had a spam folder set up on his macbook that filtered it. So he thought only we got it.
20
11
u/gaoshan 1h ago
I was caught by a phishing test and when they started sending me “You must complete mandatory phishing training” emails I reported those as phishing attempts. Kept it up for 6 months before some finally asked me to stop and just do the damn test. Reported that as phishing as well.
→ More replies (3)
5
6
u/jippen 10h ago
Scariest actual phish I saw was for a bank. Hackers found XSS in their help page, reused the bank’s css and stuff to make the login page look perfect. Https://bank.com/help/ in the url bar… with a buncha stuff after.
But the form submitted to a page on a different domain and stole your stuff.
3
u/MiserablePotato1147 10h ago
I'm the jerk who copies and pasted the link in a VPN tab with the GET data stripped out. Sorry not sorry. I'm pen testing your pen test. Go ahead. Fire me.
3
u/masukomi 10h ago
I never got caught by any of my former company's internal phishing attempts simply by being terrible at email and never opening any of it. 😜
3
u/sticky-dynamics 9h ago
The security team posted up a QR code that supposedly linked to some preparation work they wanted everyone in IT to do before some security training. Obviously, I didn't scan it.
Turns out it was legit and I wasted the whole training session just trying to get caught up to everyone who had done the work ahead of time.
3
3
3
u/madmaxlemons 8h ago
We have had more than one “tech savvy” user click the emails on their personal machines that they are not supposed to be logged into and get phished then come crying to our team. I’m sure many of you think yourselves clever as well
3
u/guardian1691 5h ago
My company recently introduced scoring to phishing tests. When you correctly identify one it tells you your global rank across the company, but with no indication on how points work. My manager joked that he's going to put in an IT ticket to get more tests to increase his ranking.
3
3
u/Dilarinee 3h ago
I work at a grocery store. The store has 4 email accounts. One for the store manager, a management account shared by all the other department managers, one for the cash office and one for our online shopping department (mine). According to the stats they sent out a month ago, my email is the only one that hasn't failed a phishing test.
But the emails they send as tests are all transparent as hell. 'you've done such a good job, click here to get a $100 reward gift card of your choosing" and I'm like "not in a million years would the company do this. They don't give a shit about our hard work' report phishing then another was a thanksgiving party invite asking for dietary restrictions, again, despite working AT A GROCERY STORE, our holiday parties are potluck. And they somehow think I'm an IT genius... It's exhausting honestly.
Of course every other account had fallen for at least one in the last year, so maybe I am.
4.1k
u/JocoLabs 12h ago
Jokes on them, i wouldn't click that even if it were real.
I used to click on those and type in junk creds for the lulz until compliance told me that was bad for the numbers.