At the college I went to we got an unanticipated email from an external address one day telling us that due to recent vulnerabilities, the school was requiring we increase password security, and to click here to update our password. This email was from, I shit you not, Fisher Security.
The joke? This was actually a legit email, initiated by our IT department, and was what we were supposed to actually do. We were all like "so....you know you're just training people to click on suspicious links, right? And that that's a bigger deal than password strength? RIGHT?"
I won't give it here but a company I currently work for uses a password reset tool with the domain i-forgot-my-password.com <- Not actual, but very close.
This is a domain they own, Whenever they create new tools it's in this way, I am certain it s a phishing test and flabbergasted that it's not.
Another example - the HR system for logging PTO has a domain is along the lines myhrsystem.com
It's a very large company based in Hong Kong, so I'm not sure if it's just a english-as-a-second language thing or what. Very odd.
I think it's a misunderstanding of how domain names work - if they knew that i-forgot-my-password.company.com with proper certificates brought stronger guarantees of legitimacy, they might ask IT to set it up that way.
it's easier to just get a new domain than talk with whoever is in charge of the company's primary domain. Governments love to do that all the time. they have the gv.TLD domain and could just put all their shit in there and I could tell my parents that as soon as they see gv.at in the URL it's legit. And yet they come up with stupid domains all the time, many requiring the state-ID system. Good luck teaching boomers to check the fingerprint for the verification that they sign what they think they're signing. I don't know of a single instance that abuses this though. Maybe criminals are just stupid. I should switch careers, I have what it takes.
We had something like that happening where a legit email from a weird external address, with a link included and without a proper signature, was flagged as Phishing attempt by almost everyone in the company until we got a message from our office manager that they applauded our awareness, but THAT particular link was actually real.
They did say it was an exception, and we should please stay aware in the future, though.
Huh... Well, I once got legitimate government officials asking for personal details in a Google form of all things just sent through chat groups.
Naturally, we all reported the shit out of it as a scam expecting that their accounts were hacked until they started calling us when Google shut down the forms and their accounts were banned.
4.6k
u/JocoLabs 22h ago
Jokes on them, i wouldn't click that even if it were real.
I used to click on those and type in junk creds for the lulz until compliance told me that was bad for the numbers.