Loading…
15
My boss clicked a link in a fake UPS email last Tuesday and now our whole office has to do security training
We're a 12 person insurance office in Dayton. Last Tuesday around 9am he gets an email saying a package was held at the warehouse. He clicks it, types his login on the fake page, and by lunch the IT guy is telling us someone tried to log into our client portal from another country.
Nothing got stolen that we know of, but now they're making all of us sit through a 2 hour training video. I get why, but the video is from like 2015 and just says "look for bad grammar" over and over. My boss is the one who fell for it and he's still clicking stuff.
Anyway I want to bring something to our next staff meeting that's actually useful. What do you all look at first when you get a weird email? Is there a quick way to check if a link is sketchy before you click? Or a browser thing that blocks this stuff? I'd rather not be the next guy.
1 comments
Log in to join the discussion
Log In1 Comment
the_anthony17d ago
The "look for bad grammar" thing is the worst advice because half these fake emails now are written better than the real ones. My rule is I never trust the display name, I hover over the link and read the actual address it points to, and if the domain is a bunch of random letters or ends in something weird I just don't touch it. You can also copy the link and paste it into a site checker like VirusTotal or urlscan before you click anything, that takes ten seconds. For the browser thing, turn on Google Safe Browsing if it isn't already, it blocks a ton of these pages and screams at you before the login screen loads. The big one for your office is that your boss needs to stop clicking, so at the meeting push for two step login on the client portal so a password alone can't get anyone in.
5