FAKE Phishing !?!

[Friendly Angel]

My company created its own phishing e-mail and sent it to everybody to see how many people would fall for it.

The e-mail looked like it was coming from our own IT and said your password was compromised and click here to re-instate;  phishing link then stole names and credentials of employees.

I'm not sure how I feel about this trickery, but I feel even less positive about how many people it apparently fooled.  We just got an e-mail about it.

I didn't remember it at first, but it's in my deleted folder.  I'm pretty sure I didn't click, but it was convincing.

[PANTS!]

Yeah - They are doing it here too.  I have caught it three times out of three, and I hope to God that mans they don't waste my time anymore. 

I also am unsure of the tactic.  Not the least of which is that they put the responsibility of the bad-click onto the victim.

[Friendly Angel]

I predict we're in for some training.

[Morvis13]

at my old company they did this and provided pizza with the training. people would click the phish just to get free lunch.

[st3class]

They do it regularly at my company, and I actually think it's a good idea.

For one thing, they have made it very easy to report phishes. We just a push a button in Outlook and everything is done for you.

Also, being on the lookout for IT-generated phishes means you're also on the lookout for real phishes. What I would really like to see is some reward for spotting a certain number of phishes.

[HighPockets]

we've got the same PhishMe button for outlook, we get entered into a drawing for a $25 gift certificate once a month every time you identify a valid scam.

[Soldier of FORTRAN]

I'm for it.

Security policy requires compliance.  A little Red Teaming now and again mitigates complacency. 

Remember: Security is a daily practice.

[The Latinist]

I hate to admit it, but I clicked on a more subtle phishing E-mail last week.  Safari caught it and wouldn’t let me visit the site.  I’m also certain that I wouldn’t have given my actual credentials. Still, it will drive out the complacency on my end.

[John Albert]

This is a pretty common tactic of IT security teams in corporate America. I've been encountering these kinds of 'tests' for decades. Even got caught up in them once or twice.