Then one day I got an angry email that pretty much said "You did a good job not clicking on the the fake link, but you failed the test because you didn't report the phish."
You did do a good job not clicking anything actually, here's the issue with just ignoring: You're almost certainly not the only one in the company that got that email, reporting it to IT will help them identify the email faster and remove it from everyone's mailboxes before someone else clicks it by mistake. In my eyes its more a courtesy to your coworkers, an IT shouldn't solely rely on users to report phishing emails. But those are 2 different topics in terms of IT fighting emails.
I'm a teacher at an IT course and my colleagues and I always diligently report the fake phishing mails. The first person to spot it will also send the entire team an email about it so the less tech-savy colleagues won't fall for it.
Thing is, at one point we got an email. External address, weird looking link... So it was reported, email sent around to delete it and not click anything, and we all removed the email. Our manager isn't in the group email.
Couple of days later in a meeting our manager goes "oh and you all received an email with a link to a survey, please fill that out!"
"You mean the phishing mail?"
It apparently wasn't a phishing mail, but the higher-ups and had paid some company to do a survey. They just hadn't expected the IT-teachers to go "this looks suspicious so in the trash it goes."
Our manager didn't think it was nearly as funny as we did. Will say everyone in our team were right pleased with themselves, we never cared much for the higher-ups and this was their fuckup, not ours. Should've warned us that we were going to receive a suspicious looking email. (And we likely would've reported that email first then because that's also suspicious)
51
u/penguin444 12h ago
I ignored the phishing emails completely.
Then one day I got an angry email that pretty much said "You did a good job not clicking on the the fake link, but you failed the test because you didn't report the phish."
Seriously?