How to recognize phishing

I have a friend in cybersecurity who conducted a simulated phishing campaign on a local school district’s employees. He knew open enrollment for insurance was almost over, which made for a perfect topic for his campaign.

He grabbed a list of all employees and used social media to try and guess which employees had children (i.e., introduce more urgency because children were involved). He sent a targeted phishing email (known as spear phishing) to all employees he suspected were parents, stating that their enrollment had an error, and if they didn't act soon, their dependents wouldn’t be eligible for coverage (i.e., creating the ultimate sense of urgency).

The response rate for this simulated phishing email was abnormally high, thanks to the targeted nature of this campaign as well as a sense of urgency to act before time ran out.