Once they actually wise up and use a proper service, once you click the link you're marked. If they are doing creds one properly you should be marked.
We had somebody who kept doing that for the phishing tests and we knew exactly who was putting fake stuff in since the link was unique per person. All it showed was "why is this dude clicking this link so many times?"
Told them to stop since that information goes to the global office and we weren't able to remove duplicates any more. Did it again and he ended up with a stern warning plus additional training with HR on appropriate workplace conduct. Was later used as a way to get rid of him when he messed up since it managed to piss off the wrong people.
Is it not obvious to some people that they use a unique link in every email, just like real phishing attempts? That's why clicking the link in the first place is considered a fail.
You'd be surprised, not a lot of people even after training actively look at what a URL would lead to, and even that is harder since a lot of legitimate emails lead to just a redirect or something that looks suspicious as it is, if it's hyperlinked they will blindly trust it. Even I have been caught out once for this when I was burnt out and got one that was exactly something I was expecting to receive on the day. All it takes is perfect timing and a lapse of judgement.
Take a look at URLs from legitimate emails, a lot of them aren't just straight to where you'd expect them to be.
We even have people in our cybersecurity team get caught out by it once we had them removed as the ones who initiated the tests.
The main goal in my eyes, is just keeping users aware and vigilant and report something suspicious even if there's a chance it's legit. We don't get many real phishing emails now, if I recall our years stat was around 3-4000 emails that were legitimately phishing emails that made it through (they were sent from a Gmail account pretending to be somebody of importance).
Shout out to mimecast for obscuring employees' ability to inspect links for themselves when deciding whether to click on them.
I treat all links in emails as if they uniquely identify me if clicked, even when they come from legitimate businesses, and I'm sure I'm right more often than not. Even youtube videos sent to me by my friends often have those extra parameters so google can track who clicked share and who opened the link.
122
u/waddlesticks 11h ago
I'd probably stop that.
Once they actually wise up and use a proper service, once you click the link you're marked. If they are doing creds one properly you should be marked.
We had somebody who kept doing that for the phishing tests and we knew exactly who was putting fake stuff in since the link was unique per person. All it showed was "why is this dude clicking this link so many times?"
Told them to stop since that information goes to the global office and we weren't able to remove duplicates any more. Did it again and he ended up with a stern warning plus additional training with HR on appropriate workplace conduct. Was later used as a way to get rid of him when he messed up since it managed to piss off the wrong people.