I recently had one that was like “Due to recent events, we feel it necessary to remind everyone about the regulations in the Code of Conduct about accepting gifts from clients. Please read the CoC if you have not done so and confirm you have read it via this link. Signed HR”. The link was fake, and the sender address was, too. It was a good fake though, because we actually do have a CoC and have to read/confirm about once a year. So I’m pretty sure it was a test to select people for training.

Yes, you can identify them by the X-Phish header. I hope real phishing mails have it too

Look at the URL before you click. Enforcing plain text mails makes it easier.
Spam/phishing also usually neglect the plain-text part in copying company mails. Yeah, a lot of shitstain companies too, but spam still looks different in plain text.

I’m not going to remember the exact domain of the survey company we use, what are you crazy?

I agree, and have decided to err on the side of caution, and also put the irritation over on higher-ups. If I get some link I’m required to click that I’m not actively expecting from an unrecognised address, just trash the email. A couple times, I’ve gotten follow-up from a superior asking me why I haven’t responded to <survey>, and I just tell them I haven’t seen it and that it probably got caught in my spam filter. They send me the link in question, and I respond.

I quite quickly realised that most of those surveys they need “everyone” to respond to will just slide quietly by when I do this, so I don’t need to spend time on them. My reasoning is that if it’s actually important, I’ll get it through a reliable channel, and so far that’s worked.

To be fair, I also dump anything that comes from some variant of “noreply” to junk. I figure that if I can’t reply, and I’m not actively expecting the email enough that I check my junk folder, it isn’t important.

We use mimecast, so all links in emails are replaced with links through mimecast for them to check.

That means you can’t see the original link easily though… So makes it harder to check if they are iffy.

There’s so much bullshit that I just erase quicker than my shadow. When that thing on the bottom left pops up, there’s a trashcan on the notification.

I erase anything that is not addressed to me directly in that split second.

My former workplace stopped publishing the stats on which department had the most failures when the first round showed more than half of the executives clicked the scam link in their email.

They do that here routinely. The last time they sent it using the email account that is basically the one email that you do not ignore because they use it for urgent “please push the patch asap” type emails.

If that email is compromised they got bigger issues.

Jokes on them, I don’t open any emails. For security, of course.

Did they complain to HR about the squirt bottles?