Sometime soon, at an office we look after, somebody will get an email about a package they never ordered. Or an invoice from a vendor whose name is one letter off. It will look almost right. And if they click it, nothing bad happens: no malware, no stolen password, just a plain page that says, more or less, this one was ours. Here’s what would have given it away.
We send those. On purpose, on a schedule, to people we like. If your IT company is going to phish you, you deserve the whole story, so here it is.
Some of them aren’t that good
We would love to tell you every fake we send is a little masterpiece. Some are. Some aren’t that good, and we know it, and we’ve made peace with it, because the real ones aren’t always good either, and because catching our fakes was never the point of sending them.
Here’s the entire machine, since we’re showing our cards anyway. The emails go out spread over time, unannounced, in different costumes and at different difficulty levels. A click lands on a short teaching page: what this was, the tell you missed, the tell to keep. A couple of minutes, then back to work. The clicks and the catches roll up into a report on how the office is doing as a group.
Which makes us an odd vendor to pay, if you think about it. A month where nobody falls for anything looks, on paper, like we did nothing at all. It’s the best result we sell.
A little paranoia is the right amount
A fire drill doesn’t need the building to be on fire. Everybody knows it’s practice, and the legs learn the stairwell anyway.
That’s the first reason we send them. The drill keeps a small, useful doubt alive, and a little paranoia is the right amount: it means people are watching. Someone who’s been drilled hovers on the sender’s address a half second longer, notices the reply-to, walks down the hall to ask “did you actually send me this?” That half second is most of the defense on the day a real one gets past the filters, because the real one will not announce itself, and no filter catches them all.
Nobody wants the redirect
The second reason is more human, and we promised the whole story, so, plainly: everyone knows the click lands somewhere. The person who clicks sees the teaching page. The boss sees the report. So do we.
Nobody gets marched anywhere over it. The report’s job is tuning the next round and the training that goes with it. But people would rather not be on it, and that mild preference does quiet work all year, the same way a bowling league makes Tuesday nights serious: a little friendly scorekeeping among people who like each other. Some people are moved by the habit itself, some by the scoreboard, and a few simply cannot stand the idea of being got. All three end up in the same place, reading the sender line twice.
If you clicked one today
Maybe that’s how you found this page: the link, the page you didn’t expect, the warm ears. Come sit by the coach for a minute.
The fake caught you on a rushed day. Rushed days are the only days that count, because that’s when the real ones land too. The whole program exists so that the day this happened to you was a practice day: you paid for the lesson with a flush of embarrassment instead of a stolen mailbox, and that’s the best exchange rate in security.
Shame would wreck all of it, so we don’t deal in it, and we ask the offices we work with not to either. There’s no wall of names. Keep the tell the page taught you, and report the ones that look off even when you’re only half sure. The person who clicked is the person this program exists to protect, and in our reports, the one who clicked in March is so often the one quietly flagging the strange stuff in June.
If you run the office and you’re weighing a program like this, two questions will sort any provider, us included: where does a click land, and how do the results get talked about? You’re listening for a lesson on the other side of the link and kindness in the follow-up. Built that way, the program gets you a team that watches. Built to embarrass, it gets you a team that hides mistakes.
If you want to hear how we’d run a first campaign for your team, ask us.