My Employer Tricks Me With “Simulated Phishing”

Sometime last year, my employer decided to implement a “simulated phishing” campaign which involved sending out “fake” emails to all employees in order to try to trick them into clicking a malicious link, or opening a malicious attachment, or giving away their login credentials – all in the name of “educating” us. Instead of educating it me, it drove me into a state of paranoia and mistrust.

A couple of weeks later, I received my first email that was obviously a scam. “Dear university employees, It has come to my attention that u have not paid your employment fees. Please make payment immediately by click the following link. If u do not make payment today, your contract will be terminated. Yours Sincerely, Vice President University”. Okay, so that was obviously fake, but I reported the email anyway as we were trained to do, and the IT department congratulated me for spotting their first fake email. Success! At first, this all felt more like a bit of a game than anything else.

Another email came a few weeks later, this time, a bit more personalised. “Hi Stephen, I thought you might be interested in this link: ‘Three ways for university employees to get a BIG promotion’. It’s a really good read! Cheers, Peter”. So, hovering my mouse over the link as we were taught, it said something like, fake-link-do-not-click”. Again, I reported the email and yes, it was a simulated phishing attack.

But then, the IT team decided that they were being a bit too easy on us and stepped up their game convincing me to enter my login details. When I did, I was met with, “Haha, we tricked you! Fortunately, this was just a test as part of our simulated phishing awareness campaign”. At this point, I started getting a bit upset. I mean, they were sending out fairly realistic looking emails that could very much have been true, but then almost making us feel a bit foolish when we clicked on them.

Then a few more weeks later, I was sent another email that was obviously fake threatening to suspend my university account if I didn’t take action. Unfortunately for me, the “fake” email wasn’t actually fake and my university account was suspended.

I think that’s the inevitable consequence of these so-called “simulate phishing campaigns”. Exposing people to a barrage of fake phishing attacks clearly has unintended consequences. They make otherwise competent and dedicated employees feel embarrassed and perhaps even ostracised. They make us feel potentially paranoid, and suffer from ‘analysis paralysis’ where even when we receive a legitimate email, we don’t take action due to the fear that we might fall victim to another one of these fake phishing scams. All this campaign has done, I think, is have a negative effect on employee morale, and has created a culture of mistrust. Is that what the university wanted? Perhaps it was.

MUSIC
Melancholia by Godmode

#simulation #phishing #phishingattack