PHISHing is a problem for corporate America.
In this corporation, they have attempted to address that problem.
They send out official-looking emails in the manner a phisher might employ. If you incautiously click on it, you get tagged with a big sign that says "YOU FOOL!" and explains how you just fell for phishing, and will prevent the allies from winning the war.
Last week, one guy in our office got an email from the Corporate Training coordinator. Being suspicious, he called Corporate Training about the email. They assured him it was legit.
So he told us that it was okay to read the CT email and we all opened it. YOU FOOL, it said. Plus we were assigned to complete PHISHing training at our earliest inconvenience.
Dammit.
So now we're suspicious of all company emails.
I got one this morning. First thing it says
ACTION NEEDED: Self-Inspection Activity
THIS IS NOT SPAM/PHISHING
Alarms sound in my head. This is just like those emails my dad sends that say 'Don't bother to check this on SNOPES, I already did and it's legit.' NONE of the emails that say 'I already checked and it's legit' turn out to be legit.
So I report this for phishing. Forwarded to security's manager.
I mean, obviously, the first thing I would do if phishing would be to assure my coworkers that it wasn't phishing.
Plus, it would really suck to fall for it and put security in a position to say 'Dummy, why did you believe the email?'
Turns out that it was legit. But they've got us so paranoid, I marked the 'it's legit' announcement as phishing.
Security tried to lecture me on the proper procedure if I suspect PHISHing. But I pointed out that when we did THAT we ended up with an extra hour of training. So screw them. I can't trust anything that appears to be from within the company OR anything that actually is from inside the company.
What's the procedure to use when the 'procedure to be used' doesn't prevent phishing?
They won't answer that. I hope they're rethinking their strategy, though they might just be organizing my transfer to Reykjavik...