This. If my bank contacts me I want it to be legitimate and honest. If I started getting phishing attempts I'd start ignoring my banks contact attempts completely. So when someone skims my card, makes some purchases and they try to ask me about it, I'll ignore them. Not good.
I remember thinking I received a scam call from my bank over an account, and I very nearly hung up on the lady (normally, I'll say something mean/hilarious, but I thankfully refrained from it this time).
The ironic thing is what made me realize it was legitimate: She was initially asking me about my physical address; I didn't give her the information but asked what she had on file. Two numbers were transposed. When I realized it was probably legitimate was when she was trying very hard to send me a bill for a statement they mailed to the wrong zip code, and she was insisting that I must have lived in that town at some point.
I told her I wasn't going to pay them a cent for a mistake on their part, and that I needed to talk to my local branch. So I hung up, called them, and found it it was legitimate. One of the employees transposed two digits on an account I'd just set up about a month prior.
But holy crap do you have to be careful about giving any information out. I can't imagine if this had been a phishing attempted from the bank itself. I think I would've dumped them to be sure!
Running managed phishing campaigns against your internal staff erodes trust too. It’s a widely implemented practice but I’ve never seen evidence that it actually improves security or whether the negative impacts of trying to trick your own staff are actually worth the tradeoff. My sense is it’s really only useful for measuring how porous your organization is to phishing to decide how to invest in training/other security efforts.
I suppose with internal users you can theoretically target test-failures for individual training or performance intervention - for customers you can’t do that.
I received an internal simulated phishing email to my work address, masquerading as a fake Google Play invoice - which happened to show up thirty minutes after I had adjusted payment details on a Google play subscription under my personal email.
It was obviously fake, but the timing was so suspicious, and it came in to the wrong email address - so my first thought was not ‘ah, here’s my Google play invoice’; nor was it ‘ah, a phishing test, let me report it and feel smug’. It was ‘oh crap, my phone must be compromised’ - if someone knows I just updated a Google play subscription, and they cross-associated it with my work email, the only place those come together is on my phone.
Then when I got confirmation that it was a simulated phishing email, my second thought was ‘wait, did the corporate endpoint security system monitor that I was just on the Google play store and send me a targeted phishing attack?’ - which is a significant hit to the degree of trust I place in my employer.
Turns out no, it really was just a randomly selected phishing template and a wild coincidence. But for me it says it is a very bad idea to send out phishing emails that masquerade as real services your employees might use in their private life.
That's a really good point, and its a tough needle to thread.
So my train-of-thought goes something like: If my customers are going to get hacked, its better they get hacked by my good-guys than actual criminals. If they're more suspicious about clicking on links from my bank (or links that LOOK like they're from my bank) - it isn't necessarily a bad thing.