The Worst Kind Of Clickbait

As part of our IT security training, my employer started sending out fake phishing emails a few times a year. If you clicked on the link or opened the attachment on one of those, you ended up getting remedial training on how to spot a scam. The correct action was to mark it as spam and move on about your day.

This worked well for raising awareness. Then, one day, the company decided to contract with a third-party company to implement a text-based welfare check system. Basically, if there was an incident in a particular location, like a blizzard, everyone in that area would get a text asking them if they were okay and if they needed anything,

They didn’t announce that they were doing this, so the first any of us heard about it was when we got an email from an unknown external address asking us to go to a website and enter in our company location and link our cell numbers to it. Most of us did exactly what IT had trained us to do; we did not click the link and marked it as spam.

They tried sending out an email from one of the higher-ups, which most people didn’t even open because these are usually time-waster emails asking us to check out their new blog posts. Finally, they cascaded the info down through the management chain so that people got messages from their direct managers.

Managers: “The email from [Third Party] is not a scam. When you got the email from them again, sign up for their service.”

But they forgot that thousands of employees marking a single sender as spam would train the filters, so the resend didn’t make it to our inboxes. Eventually, they managed to get the sender whitelisted and the emails arrived.

A process that should have taken a week instead took months because no one bothered to think that this email they were sending looked exactly like the scam emails they had trained us to ignore.