Unfiltered Story #245246

*I work IT/Service Desk for a big retail company. Since it’s cyber security month, the company is doing random things to test the user security. One of the big things is sending a phishing email to see what they do. If they were following policy they’d do one of two things: a)Reach out to us and we’d give them the correct process (forwarding the suspicious email to the phishing team) or b)Already knowing the process and sending it over automatically. Also of note, we have phones and chat. This person chatted in*

User: Just received email saying there was a security alert on my account and I needed to reset my password. I think it’s legit but it doesn’t indicate which system or password. There is a link but I have been warned against clicking on links from in specific emails

Me: If you’re unsure of the validty of an email, you can send it to the phishing team. Information can be found here: [gave them a link to our KB with the phishing instructions]

User: I can do that and I’ll reset all passwords. I thought you’d be able to tell me which system the alert came from before I reset all my [company name] related passwords

Me: We don’t know which system it came from

User: *disconnects*