I've recently gotten a pair of "User Selkie has failed the phishing test" emails to my personal account. The email has no other information, no links or anything, and while I'm not going to respond to it or do anything, I'm wondering how this particular scam works, and if there's anything else I should be doing.

Adding a few details: This is my personal Gmail account

1 Answer 1


A few possibilities I can think of.

1: Your employer pays for cyber security auditing, and included your personal email under your information.

2: It is possible that this is a precursor to an attack and you are just someone's guinea pig. Emails can be embedded with things like X-Confirm-Reading-To or Disposition-Notification-To in the header to let the sender know how far his email got. This means that the attacker knows that whatever he did validated through SMTP and anti-spam protection and that you opened his email. If he's trying to build a list of marks for a future spam campaign, something simple like this would help him keep a small cross-section on his outbound list to avoid spam filters for longer.

3: What you are receiving is redacted. Your accounts security features striped out whatever the real threat was; so, now all you get is the taughtning message.

4: There is a payload that runs on opening the email that you just can't see. You don't generally hear about these very often anymore, but doesn't mean they can't still exist.

  • To your points (which are all great and useful): 1) I'm self-employed, 2) Entirely possible, 3) I hope so, go gmail 4) I hope gmail is smart enough to beat these types of attacks
    – Selkie
    Commented May 13, 2019 at 19:11
  • For a gmail account and no boss, I'm guessing you are probably looking at #2.
    – Nosajimiki
    Commented May 13, 2019 at 19:22
  • Any way to check if those headers are embedded?
    – Selkie
    Commented May 13, 2019 at 19:27
  • support.google.com/mail/answer/29436?hl=en.
    – Nosajimiki
    Commented May 13, 2019 at 19:35
  • Note: Plenty of normal emails contain these headers; so, no need to get all tin-foil hat about every time you see them, but they are examples of how a malicious actor can collect little bits of useful information from something as simple as a plain text email to someone.
    – Nosajimiki
    Commented May 13, 2019 at 19:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .