Employers have been testing their workers by sending them phishing
emails to see if their workers fall for those phishing emails.
It's a common tactic by hackers, and if they do, well,
those employees are forced into additional training to prevent them from falling for
all these tricks by these hackers.
But they're getting trickier and they're getting crueler, especially with how they
try to bait their employees in clicking various links in these phishing exercises.
So these simulated phishing emails promise things like bonuses for
the employees, gift cards, concert tickets, and
it looks like they're getting the email from their employers in some cases.
So if it looks like you're getting an email from your employer and it says
something about a raise or a bonus, you're likely gonna trust it and click on it.
And so I wanna give you an example of one person who shared their experience
from their employer.
My work company sent me the cruelest phishing email test pretending to be
ticketmaster, notifying me that I've been moved off the waitlist for
Taylor Swift Eras ticket or Tour.
And that's the kind of thing that some of these workers end up dealing with.
Companies try to train their employees to recognize these attacks by sending
phishing tests.
If workers report an email, they pass.
If they fail the test and click a link or download a PDF,
they might get sent to additional training.
All right, so I hate how employers are doing this.
I also understand why employers are doing this.
They don't wanna be targeted by hackers.
They don't want their employees to fall for these tricks by hackers.
Just don't click any link on any email,
including an email that appears to be from your employer.
Just don't, just avoid it at any and all costs.
I actually like to ignore all emails coming from my employer.
It's a really good tactic and I highly recommend it.
Cenky, what are your thoughts?
>> Speaker 2: Yeah, no, don't do that.
But guys, it really sucks.
Bad people ruin it for everyone, right?
So I've told this story a million times about people constantly have
misunderstandings, the different genders do, different races do, etc.
If you're a guy you go to a bar and women are reluctant to talk to you,
think, my God, I can't believe women are so cold.
But what you don't know is the super awkward guy who came up earlier and
was way too aggressive and etc, that made them defensive, right?
So, those couple of guys ruined it for all the other guys and
ruined it for all the women and etc, right?
Now, it's a funny analogy, but in this case, the same thing holds.
Now we can't send links to one another because some scammers out there take what
look like normal links and then you click on it and you're screwed.
So, you have to be super careful whether it's your employer or anybody else
as to what links are being sent, but if you're an employer, what are you doing?
Why are you weirdly stressing out your own employees?
Yeah, okay, say it over and over again.
I got it, etc.
You don't want them to do it.
Could be really damaging, I get it.
But, spying in and trying to catfish your own employees.
>> With bonus email.
With emails that make it appear as though your employees are gonna get bonuses.
>> Speaker 2: [CROSSTALK] >> No, that's crazy.
That's totally crazy.
>> Speaker 1: Great for morale.
Really great for morale.
>> Speaker 2: No, you can't do that, that's nuts.
So, hey, we're gonna give you a bonus.
You're gonna get super excited, and they're, I'm just kidding.
Not giving you a bonus.
In fact, we're punishing you for daring to hope and clicking on and
daring to think we would be good people and give you a bonus.
>> Speaker 1: Totally, yeah.
>> Speaker 2: I just can't think of anything worse.
What a terrible idea.
>> Speaker 1: Sarah Fiete regularly received phishing tests and
training at her old job.
One email from last December, however, tripped her up.
It said the company wanted to thank her for
her hard work with a gift card and to click a link to claim it.
When she clicked it, it said she had failed a phishing test.
>> Speaker 2: Come on, man.
>> Speaker 1: No, really great for morale.
Definitely keep doing that companies, I'm sure they love it.
By the way, if the problem is email and it appears that is the problem, right?
And I hesitate to say this because I don't like using this myself,
but if the entire company moved off of email and
decided to use Slack instead, maybe that's a solution.
But wasting your employees time with additional trainings in order to
avoid phishing scams, I just don't think that's the best solution.
>> Speaker 2: No, look, I know you hate meetings, but the training is
the training, and these phishing scams can do a lot of damage to the company.
>> They can.
>> I get it, right?
But don't phish your own employees and then go, ha ha, we busted you.
Look, corporate rule is bad enough as it is, but when you turn it into some
weirdo torture chamber where you're constantly being tested and zapped and
zapped and zapped, it's too much to bear.
Do it a different way and you could have consequences for
people that actually fall for a real phishing thing, endanger the company, etc.
I get it.
You've gotta protect yourself, but this is not the way to do it.
Who wants to come into a place of work where you're constantly, yeah, come here,
there's something really good.
Just kidding, you're caught, you bastard.
It's all your fault for thinking there could be good things in the world.
>> Speaker 1: It's a similar, okay, hear me out on this.
It's a similar dynamic to what some experience in kind of
a toxic relationship, right?
Toxic relationship where one party or
another decides to constantly test their partner, right?
In various ways, I can't think of a specific example, but it's more,
I don't know, to see if your partner is gonna be unfaithful to you, right?
That's not a sign of a healthy relationship.
This is kind of similar in that, you're testing your employees because
you don't trust them to be smart enough to do the right thing.
But then you're intentionally sending them phishing scam emails that are super,
super difficult to figure out, right?
So if it looks like you're getting an email from your employer mentioning
a bonus, well, then you trust your employer.
You're gonna think that you're actually getting a bonus.
You're gonna click on that link.
I wanna give you another example.
So one of the companies that creates the templates for
these phishing tests is KnowBe4.
Let's go to graphic seven cuz I wanna give you an example of one of the crueler
templates they use.
KnowBe4 has a controversial category with more heartbeat skipping templates.
One email says it's from a Twitter user alerting people that their information
was found on the infidelity website Ashley Madison, which had a data breach in 2015.
Any workplace test, such as an email from a company's human
resources department requesting a meeting or
sending a note about updated pay scales is also considered controversial.
So these are only used when a company's cybersecurity team believes that
the organization is ready for tougher tests.
So it's you pass the tests and then the company is, we got tougher tests for you.
Is this what the executives are up to?
They're sitting around thinking about tougher tests to do on their employees?
>> Speaker 2: Yeah, not only does it mean you're not trusting your employees, it
also means indirectly and partly directly telling your employees, don't trust us.
If you see an email from us, we'll probably try to screw you.
If it looks good, you're gonna get a pay scale difference or a bonus,
no way you're gonna get it.
Instead, we're gonna find a way to punish you.
So, look, it's fair to say, hey, ask if you're not 100% sure.
Is it real?
Especially inside your own company,
it's easy because I hope they don't punish you for asking if it's real.
Otherwise you're in a no win situation, right?
If something looks too good to be true, it probably is, but just ask.
But last thing is, in that test, that test is mental.
That's HR asking you for a meeting.
What are you supposed to say?
No, F off.
No, then you get in trouble if you'd said that.
So I know you're not supposed to click on the link, but this is getting super weird.
Nobody's gonna know if there's actual meetings.
No one's gonna know if there's an actual bonus if you should actually respond to
HR, or if it's, if you respond to HR, you get fired.
If you don't respond to HR, you're gonna get fired.
Come on, it's a torture chamber.