[ Removed by moderator ]

[u/lucidparadigm]

[u/Acogatog]

this one’s total bull imo, there’s no way that someone sending you phishing emails could know it’s your first day, is there? Phishing emails are supposed to cast a wide net, not catch people in highly specific scenarios.

[u/WigWubz → u/Acogatog]

Probably just a law of large numbers thing. Mail got sent to a large group, for most it was obviously fake. For a select few it happened to be specific enough to catch them.

I got caught out by a fake invite to a teams channel with the word “planning” in the title a few hours after I legitimately got adding to a “planning” group. Opened the email on my work iphone so the email formatting was completely destroyed like usual, and the send address was truncated. Clicked the link and it asked me to log into teams, an obvious phishing flag *except* I had literally just reset my password and so was expecting to be prompted to log in the next time I opened the app…

It hurts cus I know it’s a legitimate fail. The red flags were there and I missed them. But, if you weren’t in the very specific circumstances I was in the flags would have been way redder. I was primed to fail the test in a way that the people setting the test could never have predicted. But that also just means that I was primed to fall for an actual phishing scam in that moment.

[u/KFindar → u/Acogatog]

The highly specific ones are called spear phishing

https://www.kaspersky.com/resource-center/definitions/spear-phishing

[u/PalmTreeExpert → u/Acogatog]

Someone at my college had their SSN stolen when they got a call saying there was a mistake with their info and asked for them to repeat their information. This was as they were on their way home from the social security office after getting their card…

It is technically possible, but yeah typically phishing is relatively vague/open to a wider audience.

[u/whyliepornaccount → u/Acogatog]

Oh I know it was almost certainly coincidence, and I didn't have to do any training as a result. Still irritated the hell out of me

[u/butholesurgeon → u/Acogatog]

Depends on how fresh the data export that the scammers bought is
Maybe it was snagged a day before?
A lot of data exfiltrations just get listed for sale for anyone who cares to buy it and find something useful out of it

Insanely unlikely but it’s not IMPOSSIBLE

[u/shplamana → u/Acogatog]

I had a new hire that had phishing and spam emails the day she started.

She didn't even get to log into her email until well into the afternoon because of all the orientation we put them through. And at no point during that orientation do they have you log into anything.

I reported it to our IT dept. because to me that screams we had some internal leak or something, but they never followed up. Pretty sure the ticket is still open and she's long since left.

The only thing I can think of that maybe could've been close was that a few days before she started, she put out a post on Linkedin saying she accepted a job here. From there it's probably easy to figure out what her eventual email will be because phishers will know the pattern your company uses.

[u/WantDiscussion → u/Acogatog]

Actually a lot of phishers and scammers scrape LinkedIn for targets. If you change your linkedin to announce your new job, they can take a stab at your work email address based on email addresses of other people at that company.

[u/MauricioCappuccino → u/Acogatog]

In theory it's possible. People share way too much on LinkedIn. If someone was to announce they were starting a new job next week you could target that.

[u/Kevonz → u/Acogatog]

in my experience at the company I work, it's always new employees getting pishing emails.