Cyber criminals have a number of tricks up their sleeve that they use to get their unsuspecting victims to click on the links in phishing emails.
Here's how you can accurately test the responses of your end users with a well-crafted phishing simulation that leverages real-world techniques.
You'll also be able to assess your employees' resilience to sophisticated scams with a free employee phishing simulation using usecure's easy-to-use tool, uPhish.
How to create a successful employee phishing simulation
These are our top five tips:
-
Carrot or the stick.
An end user will only click a link on an email if they have something to gain by clicking it - or something to lose by not clicking. The better the promise, or the scarier the threat, the more likely they are to click.
Consider: What does the user have to gain by clicking the link?
-
Familiarity.
Most end users these days have enough know-how to think twice before clicking on links in email from people they don't know. Is an email purporting to be from their own CEO, or from a software tool they use? They'll click before they can finish reading.
Consider: Does the email pose as a person, team or service the user knows? If nothing else, drop in the company's name to make the email customised enough to get a user to click.
-
Authority.
If the email poses as coming from someone in a position of authority, it is more likely to grab attention, and get the user to act immediately.
Consider: Could you write an email that poses as the company CEO or a senior director?
-
Urgency.
The most likely way for a user to not compromise in a phishing simulation is that they're given time to consider - or hear about the simulation from their colleagues. To avoid this, make the email urgent.
Consider: Is there any time limitation on the email? The email could offer something to the first ten users who click - or ask all employees to complete by end of the workday under risk of penalty.
-
Timing.
End users are far more likely to click on emails that arrive during office hours. Even better, they are likely to immediately click for emails when they're at work and looking for easy distractions - such as Friday afternoons.
Consider: Are the users going to be at work when the email is sent out? Are they going to be busy or looking for a distraction?
Example phishing email
The email template below - created using usecure's phishing simulation tool - has been used in numerous successful phishing simulations - with an average compromise rate of 39%!
The email promises the receiver information on the new company holiday policy. Who wouldn't click on that in a heartbeat?
The email succeeds because it:
-
Promises something desirable - information about holidays
-
Is familiar - it mentions the name of the company
-
Is urgent - the title says 'Action Required' and it mentions the policy is changing soon.
Start testing your organisation's human resilience to phishing
Launch a free phishing simulation with usecure's uPhish simulation tool to detect which employees are vulnerable to common scams.
- Calculate the risk by launching a free phishing simulation
- Understand the risk by tracking opens, clicks and compromises
- Easily get started with a library of readily-made templates
Watch a demo, or launch a free phishing simulation today.
