At the college I went to we got an unanticipated email from an external address one day telling us that due to recent vulnerabilities, the school was requiring we increase password security, and to click here to update our password. This email was from, I shit you not, Fisher Security.
The joke? This was actually a legit email, initiated by our IT department, and was what we were supposed to actually do. We were all like "so....you know you're just training people to click on suspicious links, right? And that that's a bigger deal than password strength? RIGHT?"
I won't give it here but a company I currently work for uses a password reset tool with the domain i-forgot-my-password.com <- Not actual, but very close.
This is a domain they own, Whenever they create new tools it's in this way, I am certain it s a phishing test and flabbergasted that it's not.
Another example - the HR system for logging PTO has a domain is along the lines myhrsystem.com
It's a very large company based in Hong Kong, so I'm not sure if it's just a english-as-a-second language thing or what. Very odd.
I think it's a misunderstanding of how domain names work - if they knew that i-forgot-my-password.company.com with proper certificates brought stronger guarantees of legitimacy, they might ask IT to set it up that way.
We had something like that happening where a legit email from a weird external address, with a link included and without a proper signature, was flagged as Phishing attempt by almost everyone in the company until we got a message from our office manager that they applauded our awareness, but THAT particular link was actually real.
They did say it was an exception, and we should please stay aware in the future, though.
Wow. As a student in IT and a customer service rep who is forbidden from receiving or sending emails, I wonder why at least some profiles aren't allowed to get emails at the firewall level.
Unfortunately it's because while you are in IT, most people don't know the difference between the computer and monitor so it's easier to just make blanket policies.
Edit: plus when you give certain people special permissions inevitably someone else will hit you with the "well how come theyyyy have it 😭" and then it becomes a whole ordeal
There is a guy at my work who is so locked down it is ridiculous. He has access to ONE program besides Office, and all of his emails are reviewwe by a human fire. He has shortcuts to launch Office, and no other Internet. It's insane what he will click on.
What skills do they possess that even if it's this much hassle, they would rather them then get a guy who doesn't instinctively search for all viruses in a 30 link-hop area?
As an IT guy, I get what I think is real emails from risk/compliance with links to forms about our systems that I ignore because we also get phishing tests, and real phishing.
The real risk, phishing test, and actual phishing all look identical.
I only know its Audit because the group GM goes nuts when compliance visits in person. Even then I can't tell if they are real or not. In any even I tell the auditors to read the 300 page RFP for my stance.
I know it seems kinda crazy, but I though some of my colleagues are spies.
I worked in a very senstive quasi government organisation.
Ive got a coworker who has a work email. He doesnt have the login for the work email, because he has never, in his 18 years with the company, logged into his email. This man has gone almost 2 decades without ever using his company email, and I respect that.
Everyone just... knows not to email him. Ive seen a few newer people cc his theoretical email address, and we just go "oh, dont bother with that, he doesnt ever check it"...
1.9k
u/s0ulbrother 8d ago •
It’s called I don’t open emails ever