Inspired by this post, I just created a phishing test for my staff with a malicious URL in a "report this as spam" link, complete with a required training for those who click the link.

[–] Brickhead92@lemmy.world 0 points 3 weeks ago (1 children)

I had one a about a month ago now that I was actually impressed with how they did it.

I have a Apple account just for the kids Apple devices (required for school). Received an email from Apple support about fraudulent activity and that they'd call at sometimes. I thought that was weird and checked out the email and everything was legit.

Call came in a little early then in the email. They knew all the right details including the case number, sent a verification code to my mobile from a short code SMS "iCloud" and at that point they had me. But only until they asked me to go to a site apple.somebullshit.com. Well apple isn't going to use a domain that's not *.apple.com. went there anyway to check and the SSL cert was from Let's encrypt, apple ain't using let's encrypt.

20 years in IT, that's the closest I've been in. Very long time to falling for something.

[–] Barbarian@sh.itjust.works 0 points 3 weeks ago* (last edited 3 weeks ago) (1 children)

I know someone who got had by a spearfishing call. They knew all the details about his phone contract, sounded 100% legit. The scammer got thousands of dollars in prepaid SIM cards from his account.

After the police investigation, turned out that the scammer was actually a former employee of the phone company who downloaded a copy of the customer list when he got fired.

[–] ArmoredThirteen@lemmy.zip 1 points 3 weeks ago (1 children)

This is why even if I think something is 100% legit, if a place calls me asking for anything I tell them I have to check on it and call back. Then I'll call their known public number and go through that way. I've avoided a couple scam situations like this

[–] Clent@lemmy.dbzer0.com 1 points 3 weeks ago

This is literally the correct way to proceed in any inbound communication. Doesn't matter who it is, the more authority they claim the faster to hang up.

They will try and trigger your lizard brain and make you feel like you must act now.