Sometime last year, my employer decided to implement a “simulated phishing” campaign
which involved sending out “fake” emails to all employees in order to try to trick
them into clicking a malicious link, or opening a malicious attachment,
or giving away their login credentials – all in the name of “educating” us. It’s all simulated,
so even if we do click on a fake link, it’s not actually going to hurt anybody.
They gave us a few tips or signs to look out for such as: The email is poorly written
(there’s lots of spelling/grammatical mistakes or whatever); Emails that are “too good to be true”;
Or emails that include strange or unexpected requests that have a sense of urgency about
them.
Anyway, a couple of weeks later, I received my first email that was obviously a scam.
“Dear university employees, It has come to my attention that u have not paid your employment
fees. Please make payment immediately by click the following link. If u do not make payment today,
your contract will be terminated. Yours Sincerely, Vice President University”.
Okay, so that was obviously fake, but I reported the email anyway
as we were trained to do, and the IT department congratulated me for spotting their first
fake email. Success! At first, this all felt more like a bit of a game than anything else.
Another email came a few weeks later, this time, a bit more
personalised. “Hi Stephen, I thought you might be interested in this link:
‘Three ways for university employees to get a BIG promotion’. It’s a really good read! Cheers,
Peter”. So, hovering my mouse over the link as we were taught, it said something like,
fake-link-do-not-click”. Again, I reported the email and yes, it was a simulated phishing attack.
But then, the IT team decided that they were being a bit too easy on us and stepped up their
game. “Dear colleagues, Thank you all for you hard work this semester. As a reward, the
university would like to invite you all to a free luncheon this Friday afternoon at the refectory.
Please indicate your attendance by clicking on the appropriate link below. Kind regards,
Simon Jones, Director of Employment Services”. This looked completely legit to me,
so I clicked on the link and was met with a realistic login screen. I entered my details,
and then was met with, “Haha, we tricked you! Fortunately, this was just a test as part of our
simulated phishing awareness campaign”. At this point, I started getting a bit upset. I mean,
they were sending out fairly realistic looking emails that could very much have been true,
but then almost making us feel a bit foolish when we clicked on them.
A few more weeks went past and I received an email titled: “Two-factor Authentication Enrolment
Information – Important! Dear colleagues, As part of the university’s ongoing commitment to
cybersecurity, it will be a requirement for all employees to enable two-factor authentication.
It is important you action the following steps by Friday morning 1st July 2022, or you will be
unable to access university systems. Blah, blah, blah. Regards, Thomas Hatfield, Cyber Security
Manger”. This obviously stunk of phish. I’m pretty sure I deleted it before I even read through it.
Anyway, The morning of July 1st came around, and then suddenly I realised I couldn’t access
the university systems. I had a lot of work on that day, and I couldn’t even login. I innocently
rang IT support telling them of my situation and they said that I hadn’t actioned their two-factor
authentication and was locked out of the system. I got really upset with them telling them that I
wasn’t even aware of it, and that they should have told us about it. They said they did send out an
email, multiple times in fact, all of which I ignored and deleted. They told me the only
way for me to regain access was to physically meet them in person out at the university, which really
interrupted my day, but I had no other choice. Anyway, the IT guy that I met explained to me that
they had sent out an email, and after checking my “deleted emails” folder, I realised that was true.
But I had deleted every single one, obviously thinking they were scams. At that point, I made
a formal complaint stating that this simulated phishing campaign had resulted in me becoming
overly-cautious and ignoring valid emails. The IT team said that they’d “take my feedback on board”.
A few more weeks went past and I wasn’t receiving any fake emails. “Good!”,
I thought. I was sick of this campaign. But then just the other day, I received this email:
“Dear colleagues, It’s that time of year again where all university staff are invited to submit
feedback regarding their employment satisfaction at the university. 63% of you participated in the
survey last year, so in order to increase that number and to thank you for your participation,
all staff that complete the survey this year will be sent a complimentary $10 Coles Myer gift card
as a token of our appreciation. Please access the survey using the following SurveyMonkey link.
Kind regards, Employee Services”. So of course, I clicked on the link and was met with, “Haha,
we tricked you!”. I was livid. I don’t know why. I was just sick of being tricked by our own IT
department. I mean, at the beginning of the campaign, it was more of a fun exercise.
They told us to look out for “poorly written” emails, or emails that were “too good to be true”,
or emails that “included strange requests” – Did this email even include any of those?
Some of you might argue that the university rewarding us with a $10 gift card is “too good
to be true”, but really? Anyway, I got angry and sent an email to the cybersecurity team.
“Dear Cybersecurity team, This is just an email to inform you that I'm bit sick of all these
‘fake’ emails being sent out by ICT trying to trick employees in the name of educating us.
From now on, my only option is to ignore all generic university emails because
I can't honestly tell which ones are real and which ones are not.
I'll treat everything that comes in as suspicious. I don't know if that was your intention,
but I cannot keep being made to feel like a fool. Regards, Stephen Jones’.
And I think that’s the inevitable consequence of these so-called “simulate phishing campaigns”.
Exposing people to a barrage of fake phishing attacks clearly has unintended consequences.
They make otherwise competent and dedicated employees feel embarrassed
and perhaps even ostracised. They make us feel potentially paranoid,
and suffer from ‘analysis paralysis’ where even when we receive a legitimate email,
we don’t take action due to the fear that we might fall victim to another one of these fake
phishing scams. All this campaign has done, I think, is have a negative effect on employee
morale, and has created a culture of mistrust. Is that what the university wanted? Perhaps it was.