Phishing attacks are showing fewer red flags than they used to, helping them to hide in the communications of our increasingly busy digital lives. This month's simulations showcase how scammers use everyday scenarios – from package deliveries to software updates – to trick us into clicking malicious links. Let's equip your team with the knowledge they need to stay alert and outsmart the phishers.
Download these phishing templates for your in-person security awareness training materials!
Not to be snoozed
Bank alerts, social media updates, breaking news… our inboxes and phones are flooded with a never-ending stream of notifications. This constant barrage can be overwhelming, but important messages sometimes cut through the noise.
Unusual activity on your financial accounts is a prime example – these notifications demand immediate attention because we trust these services to protect our hard-earned money. Stay calm when you see this kind of alert.
Phishing emails often prey on our instinct to react quickly to safeguard our finances, making this a particularly important scenario to simulate in a safe environment. By experiencing this type of attack in a controlled setting, employees can learn to pause, verify the source, and take appropriate action without falling victim to fraud.
Delivering the goods
It's been a long week, and that package you've been eagerly awaiting is finally supposed to arrive. You check your email eagerly for any updates, and there it is: a notification from UPS. "We missed you," it reads. Your heart sinks. Did they come while you were out? Where's your package now? The email urges you to "update the delivery details" so they can redeliver as soon as possible. You click the button without hesitation, eager to ensure your package arrives safely.
This phishing attack preys on the anticipation and excitement surrounding package deliveries. The message creates a sense of urgency and potential loss if you don't act quickly. The promise of a quick resolution with a simple click is almost irresistible, especially when you're eager to receive your package.
By simulating this type of attack, you can teach your employees to be cautious of unexpected delivery notifications and to verify any missing information directly through the official UPS website or app, rather than clicking on links within emails.
Devious Devices
You're settling back into your daily routine after a busy week when an email from eBay jolts you back to reality. A new device has been added to your trusted devices list... in Paris. Confusion turns to alarm – you've never been to Paris! Did someone compromise your account while you were distracted? The warning "If this wasn't you..." feels all too real. The "change your password" option seems like the only way to regain control.
This phishing attack exploits our concern for account security by using an unfamiliar location to trigger alarm. The message cleverly suggests a recent login, enhancing the illusion of a credible threat. The password change option offers a false sense of control, luring victims into clicking a malicious link.
Simulating this attack teaches employees to be vigilant about unexpected login alerts, especially from unfamiliar locations. Emphasize the importance of not clicking links within these emails and verifying activity directly through the official website or app.
Zippy Updates
An email from the IT Team arrives with the subject "Critical Software Update." A sense of dread washes over you. Is this going to take forever? You skim the message, noting the warning about potential disruptions to third-party services. The attachment, "Software-Update.zip," seems legitimate. You click to download, hoping to get this over with as quickly as possible so you can get back into the zone.
This particular scam tactic takes advantage of our natural aversion to technical disruptions and the urgency to keep our systems running smoothly. The email's tone of authority ("critical software update") and the potential consequences ("disruptions to services") create a sense of pressure to act quickly. The attachment, disguised as a legitimate update, seems like the obvious solution.
By simulating this type of attack, you can teach your employees to be wary of unsolicited attachments, even when they appear to come from internal sources like the IT team. Encourage them to verify the legitimacy of updates through official channels (company intranet, software vendor websites, etc.) before downloading or installing anything.
Attachment Issues
The morning rush is on. You're juggling breakfast and emails when a new message pops up from MS Teams: "An urgent internal voice note (31 seconds) has been left for you." Your heart skips a beat. Urgent? Who could it be? Your boss? A client? You haven't checked your voicemail in a while, and a nagging sense of dread sets in. You're about to open the attachment when a thought flickers through your mind: "Wait, do we even use voice notes on Teams?"
Our fear of missing important information or upsetting colleagues is another go-to tactic scammers like to try to leverage against us . The mention of an "urgent" internal message triggers a sense of obligation to listen immediately. The inclusion of an HTML attachment, masquerading as a voice note, is a clever tactic designed to bypass security filters.
By simulating this attack, you can highlight to your employees the importance of being cautious of unexpected messages and attachments, even when they appear to be from internal sources. Encourage them to verify the legitimacy of the communication through other channels before opening any attachments.
Using a complete security awareness training and phishing simulation solution like Wizer's, upgrade your program to lay the ground work for developing a security mindset and enhancing your security culture.
That's it for this month's phishing template ideas - looking for more ideas for phishing templates? Check our blog for more examples of phishing templates.
.png)
