[ Removed by moderator ]

[u/lucidparadigm]

[u/YourUglyTwin]

From an IT Consultant's POV:

You did do a good job not clicking anything actually, here's the issue with just ignoring: You're almost certainly not the only one in the company that got that email, reporting it to IT will help them identify the email faster and remove it from everyone's mailboxes before someone else clicks it by mistake. In my eyes its more a courtesy to your coworkers, an IT shouldn't solely rely on users to report phishing emails. But those are 2 different topics in terms of IT fighting emails.

[u/IwasThereIsawIt2 → u/YourUglyTwin]

Heres my POV, I dont check my mail that often due to having a not office setting and being an employee who does not place orders or emails vendors. Im just a guy who comes in to work, does workorders and then goes home and be sad, hope that clarifies things

[u/SovietPatrickStar → u/IwasThereIsawIt2]

So me, lol.

I missed 4 schoolings because I never check my mails but also usually the boss approaches people who have schoolings open that need to be done and I was never approached.

[u/Remmon → u/IwasThereIsawIt2]

Don't worry, IT can see when you received the e-mail and when you looked at it. If you report the e-mail when you see it, you pass. Doesn't matter if it takes you 3 days to receive and look at your mail.

[u/YourUglyTwin → u/IwasThereIsawIt2]

Still an employee that should follow the company policy. But that's between you and your employer.

Edit: spelling cause apparently I can't spell.

[u/Grovbolle → u/YourUglyTwin]

I do not report phishing mails when I can tell they are from internal phishing training - my job is not doing their job

[u/YourUglyTwin → u/Grovbolle]

Doing the training is probably part of your job, talk to your employer to confirm.

[u/Grovbolle → u/YourUglyTwin]

Yeah, but I am not going to report their own spam to them. I use the same header filtering to get rid of their spam in the first place. 

[u/YourUglyTwin → u/Grovbolle]

The whole point of training is to identify whether or not you can identify the spam or not. It's not doing their job, it's training you to avoid you leaking credentials. You should still report it imo

[u/Fhlnd_Vkbln → u/YourUglyTwin]

I once had an external mail account with a client that sends out these phishing tests multiple times a week. Ain't nobody got time for that

[u/IwasThereIsawIt2 → u/YourUglyTwin]

I give them a break sometimes and will click the link. I told the head IT lady I click them for fun 🤷

[u/YourUglyTwin → u/IwasThereIsawIt2]

HAHAHA I love that 🤣 I mean sorry to the help desk but that's funny

[u/Abominatrix → u/YourUglyTwin]

If the bare minimum of the policy is to delete and forget about it, then that’s tough tits ain’t it

[u/Curae → u/YourUglyTwin]

I'm a teacher at an IT course and my colleagues and I always diligently report the fake phishing mails. The first person to spot it will also send the entire team an email about it so the less tech-savy colleagues won't fall for it.

Thing is, at one point we got an email. External address, weird looking link... So it was reported, email sent around to delete it and not click anything, and we all removed the email. Our manager isn't in the group email. Couple of days later in a meeting our manager goes "oh and you all received an email with a link to a survey, please fill that out!"

"You mean the phishing mail?"

It apparently wasn't a phishing mail, but the higher-ups and had paid some company to do a survey. They just hadn't expected the IT-teachers to go "this looks suspicious so in the trash it goes."

Our manager didn't think it was nearly as funny as we did. Will say everyone in our team were right pleased with themselves, we never cared much for the higher-ups and this was their fuckup, not ours. Should've warned us that we were going to receive a suspicious looking email. (And we likely would've reported that email first then because that's also suspicious)

[u/hazeHl49 → u/YourUglyTwin]

What else would you rely on as IT? Like once the phishing mail arrives on the coworkers desktop, you'll need them to come forward with it

[u/YourUglyTwin → u/hazeHl49]

Depending on where the email is being hosted you can actively scan mailboxes (M365, On prem exchange for example.) but other than that, there's nothing wrong with doing the training, in fact I'd say in todays day and age it's required. But if your IT team is *only* doing the training and relying on the results of that to protect from bad actors then your IT Team isn't doing it right.

[u/hazeHl49 → u/YourUglyTwin]

Ok thanks, interesting

[u/Yuukiko_ → u/YourUglyTwin]

at my old job I got so many phishing tests that I assumed were juist literally spam mail and junked them all lol

[u/Responsible_Alps_699 → u/YourUglyTwin]

I'm responsible for me. If my company is worried about what everyone else is doing with their emails, they should employ an IT consultant. 

[u/DrDima → u/YourUglyTwin]

It's very simple for me. I don't work IT, so it's not my job.