We've had some issues with compromised accounts due to users falling victim to phishing campaigns.
The possibility of us doing a phishing campaign against our own users to proactively shame them has come up.
Putting aside my personal issues with this, I have some security-related problems:
If we use an outside account as the source of the campaign:
- Account could be locked by the outside provider---and rightfully so. We will never see the replies anyway.
- Replies will be transported via external servers. These replies may contain credentials.
If we use an internal account as the source:
- Some users use external SMTP (they shouldn't, but some do). Therefore, still the chance that the reply is transported via a server we do not manage.
- It will make the message look "more legitimate" since it originates from our domain. Maybe not a fair test?
My question: Has anyone done this? How did you overcome the technical issues? Any issues you didn't foresee? I am hoping to convince management that this is not a smart thing to do but I want to be prepared just in case.