Hacker News Reader

Comment by nibbleshifter | Hacker News Reader

Even that doesn't work - some companies do exactly that with regular phishing exercises etc.

Employees get really good at spotting the tests.

The technical ones may, but they're also less likely to fall victim to the phishing schemes.

It's those non-technical folks in admin roles that you tend to have to worry about most. Those folks aren't so good at picking out the tests.

I actually found KnowBe4 to work fairly well on a large scale.

The non technical staff seem to learn to spot the knowbe4 shit real quick lol.

Yep. All of KB4s stuff looks like it came from a single designer. You need to go through your spam filter and make custom templates from whatever you are receiving, and also make lookalikes from real business messages. Bankers doing wire transfers to wrong accounts because of a forged document has been a serious problem in my sphere lately.

It used to be that if a mailbox got compromised they would just send spam about lottery wins and boner pills. Now they watch your messages and reply to a real request with a good looking response. A correct expected reply in a chain from an authentic account, just some numbers have changed. Then they will steal your contacts and register a similar domain and try to impersonate you.

We had almost this exact scenario (look alike domain) play out with a customer. Their accounts payable department almost paid out half a million to a scammer. Fortunately the employee at the customer accidentally replied to our actual email address and our folks knew better and picked up the phone. The customer insisted up and down that their email system had not been compromised. It took telling their IT folks what and where to look before they finally realized they were compromised. Good IT/security teams make all the difference.

> A correct expected reply in a chain from an authentic account, just some numbers have changed.

Ooof, that'd be a tough one not to fall for.

It's all in how much effort you put into it. It's quite versatile and their customer success team is phenomenal. We had multiple pretty smart employees accidentally fall for it the first few campaigns and immediately reach out when they realized what they did.

If being able to spot the tests doesn't confer ability to spot real phishers, then the tests aren't very good.

> Employees get really good at spotting the tests.

Then surely either the test isn't good enough, or the problem is solved?

Reply on news.ycombinator.com