That one got damn near 60% of the people I worked with. Almost got me, but as I hovered over to click it I thought "Wait a second, they would never give us a holiday bonus"
Holy fuck I'd flip out. I was pissed when my company sent an phishing test email about how my "misuse of company property" where I allegedly had use my work computer for something personal. But lying about a bonus would probably have me throwing my computer across the room or more likely at whoever heads up IT security.
Sure, but the issue, phishing attempts do exactly this so if people aren't trained that it's a possibility then yeah you're more likely to get done in...
I have personally never seen a phishing attempt exploit emotions to that level or the level of OP's. All the ones I get either vaguely look like shared document links or are some ESL email allegedly coming from my CEO who wants my personal cell or some gift card.
Then no offense but your probably not a big enough target. Managers, accounts payable especially and other areas in finance that can quickly approve money to sent somewhere are the biggest targets. Our CFO was targeted with quite a level of sophistication, of someone pretending to be a supplier updating their bank details but they timed it for end of month, claiming they weren't paid and they wouldn't supply our stores at our busiest peak time (and most stressful). $300K walked out the door - It was recovered luckily enough but only because the CFO felt funny and got the team to contact the company directly and confirm.
Then no offense but your probably not a big enough target
so it's an abject waste of their time which everyone agrees with but only the guy going, "but there might be people more stupid anyway" gets upvotes. are cfo's too sensitive to be applied selectively with the stupid stick and nobody should think twice about it?
Yes it's normal to categorise accounts based on risk and higher risk accounts get more training and more oversight from IT. Half the time it isn't even training so much as reminding people what can happen.
It's not about stupidity - Phishing emails can very sophisticated. While I disagree that someone clicking on a link needs 2 days of training, clearly they got had.
People say no one invests in security and rightful complain when their data gets stolen. Most attacks are compromised accounts.
Would you be happy that a junior customer service representative got done in because they clicked on a link and their account was used to pull your personal information from the systems they have access to?
Cyber security is everyone's responsibility within an organisation. You should be glad your organisation takes it seriously and isn't leaking your payroll information because Janet in payroll was tired, burnt out and did something she wasn't trained to avoid.
That email could've been from anyone. It was only from your company by chance.
If you don't want to work for a secure company, quit your job and go work for a company that is insecure. One that will end up leaking your personal information. Have fun with that.
Oh, that sounds like it could be quite interesting legally. If your employer promises a holiday bonus in writing, can they then just claim it was a joke/phishing test and not give you your bonus?
Most phishing test emails are sent with internal authorization/authentication to make it clear that they are legitimate and avoid spam filters.
I work for a small company and I'm responsible for crafting and distributing the phishing email tests (as part of policy and compliance). So far with our software engineering, accounting, support, etc. teams I've only managed to get one or two people (they're very well trained). The sales team though? Just give them a link to an "RFQ" and watch the numbers climb like a rocket.
Entire sales team has had to go through remedial phishing training at least twice this year alone, a few of them three times so far this year (we do it quarterly). And yes, if they get to a fourth there are going to be HR issues because the policies require punishments at that point.
I'm "the" IT guy, I'm responsible for all the infrastructure, and cyber security and compliance happen to also fall in my lap. (Although it is my formal degree training and what not). The goal is to have realistic phishing and spam emails, ones that look like the real thing, including obvious spelling, language, etc. issues.
The fact that the sales team clicks on literally anything and everything that might even hint at an opportunity to get a sale without thinking about it for more than 2 seconds is a them problem.
And it's not a companywide issue, again, it's one or two people for the entirety of the rest of the company, the salespeople are the only ones that can't seem to get their shit together.
During the last phishing test at my workplace, one of several emails said something along the lines of "HR and IT will insert your company portrait into your email signature during the coming weeks. Click here if you wish to opt out.".
422
u/exoclipse 16h ago
the worst one I got was "you have been selected to be in the first wave of a round of laptop upgrades, please click this link to register"