I got an email at work this week that purported to be an invoice for Adobe Sign.  I’m not someone who is in charge of invoices and I don’t use that software personally.  It had all the hallmarks of some standard issue phishing and I was about to delete it.

But, the more I looked at it, the more “suspiciously suspicious” it became.  The red flags were conspicuously red and it just seemed…obvious.  

It wasn’t just a phishing message, I concluded.  It was a test from our IT department.

I right-clicked on it, chose Report Phishing from the menu, and the message was gone.

A few minutes later, I got another email – thanking me for reporting the phishing test message.  It was from the IT security group and I had passed the test.

Yes.

Nailed it.

I popped open a Teams chat to a colleague in the IT security team.

“Do I get a prize for reporting the phishing test message?” I asked.

A few minutes later he replied with an animated gif of “Good Job!” and a gold star.

I laughed and sent him back an LOL.  Then sent,

“I was hoping for a scratch-and-sniff or a puffy sticker that I could put on my laptop, but I’ll settle for a ‘Good job, Anthony’ email and the animated gif.”

He sent an LOL back and said he’d look into the IT sticker budget.

I was deeply proud of myself about the whole thing – more so when I found most colleagues in my department had deleted it and even more so when I heard a couple colleagues had clicked on the link.

Amateurs. 

When I shared this with a colleague later that day and bemoaned my stickerless reward, she immediately opened up the drawer on her desk and brought out her sticker stash for me to choose one.  I picked the “silly goose” – because I am and because it was wearing an origami hat.

I was quite the clever boy.