My company: Don't click on suspicious links.

Also my company: It's employee survey time, click this link to complete the survey http://surveywhale.com/haidn39fk49cmc93mx

I mark them as phishing attempts every damn time.

Report the email for phishing attempt.

That reminds me of a recent situation.

As someone working in software development, we are required to take part in the security trainings, the usual "don't open things from people you don't know" and "verify that a link is 'known' even if you get something from a person you do know", yada yada. You know the drill.

Recently, I got an email from our Boss saying something about "Here is something that you need to click on so that you are being authorised to do this stuff". Here was my thought process:

1. This is from the boss's Email. But this cannot be trusted since it can be faked
2. This is about something we/our software can do. But I don't know why I have to do this, since this isn't really something I am part of or even know anything about
3. It looks like a legit email
4. I hovered over the link, which had some weird target location that I didn't know

So, as a good boy, I opened a new Support ticket on IT with a screenshot of the link and said: "Got an email that tells me that I should open this link, but I don't know this link. What should I do?". The response was simple: Mark as Phishing and delete the Mail, done.

2 hours later, I got a message on Teams from IT which said: "Well, apparently that mail you marked as phishing was actually from us (was legit)". Great. Mail is gone now, don't know where Outlook put it, and frankly, I don't care.

If you train your people to "question everything" and not open links they don't know where they are going, then don't use some idiotic "middle man" or referer links in your official emails either. Even better, announce things before sending something out. I don't know how many emails I have gotten over the years where I would question the content and ignore it only for it to be something more important that nobody felt the need to announce first that something like this is coming our way.

100% success rate if you mark every email as a phishing attempt.

I take great pleasure in flagging the training emails from my company's IT contractor as phishing emails. After all, they're unexpected emails with big link that I simply must quickly click on. That sounds like phishing to me!

Fun fact, those fishing emails usually share header information unique to the phishing email test service.

I already know the way to get me to click a phishing link is to send me 5 emails from the same company all 100% legit but have the unsubscribe link be the phishing link.

I would fall for that because I'm unsubscribing from companies emails all the time.

Of course now I've admitted this I'll be avoiding the unsubscribe link for a while too.

If IT did the phishing tests nobody would stand a chance lol

I used to report just about any email I got from HR/IT/Executive Management that had a link as spam... I got a lot of interesting replies from IT over the years.

Time to update your benefits SPAM/PHISHING!

Sign up for the holiday "pot luck" SPAM/PHISHING!

Tells us how you feel in thie "anonymous" survey... you guessed it SPAM/PHISHING!

IT guy here....

DAMN, that was brilliant!

I got a mandatory phishing awareness course that we were signed up to by corporate, and I deleted it because it looked scammy as all fuck.

Don't whine at people for not completing your course on phishing, when you sign them up to courses using scammy looking names without telling us first.

I'm not sure who these courses were even for. I was born in the scams. Moulded by them. I didn't see a genuine banking email until I was already a man. I remember my dad forwarding pyramid schemes to his friends on paper.

You can always forward it back to IT saying it's a suspicious link, according to this blog link you found. The blog link... Your own phishing link.

Two can play this game.

Seems legit. Click the link

Devious

Ive often suggested to our security team that they send one out spoofing the monthly mandatory training vid

Purple link, lol

The best defence against phishing I have found is to just utterly ignore my email inbox at work.

You missed our recent phishing email, try to report it next time

No, I was so cautious I avoided my whole inbox because it might contain suspicious messages.

I'm out of the loop, what happened here?

I have gotten texts from our Cybersecurity warning me not to open links in texts...and they include a link to a web page for more information.

I have a rule that searches the email headers for the test emails and just deletes them.

Don’t fall for it.