We've had some issues with compromised accounts due to users falling victim to phishing campaigns.

The possibility of us doing a phishing campaign against our own users to proactively shame them has come up.

Putting aside my personal issues with this, I have some security-related problems:

  1. If we use an outside account as the source of the campaign:

    • Account could be locked by the outside provider---and rightfully so. We will never see the replies anyway.
    • Replies will be transported via external servers. These replies may contain credentials.
  2. If we use an internal account as the source:

    • Some users use external SMTP (they shouldn't, but some do). Therefore, still the chance that the reply is transported via a server we do not manage.
    • It will make the message look "more legitimate" since it originates from our domain. Maybe not a fair test?

My question: Has anyone done this? How did you overcome the technical issues? Any issues you didn't foresee? I am hoping to convince management that this is not a smart thing to do but I want to be prepared just in case.

  • 4
    things like "•Some users use external SMTP" means that your IT department should be put on the list of shame more then the users!
    – tony roth
    May 10, 2013 at 15:06
  • Agreed. It's something that I've been advocating against for a long time. Very frustrating. May 10, 2013 at 16:34
  • Set up SPF record with -all rather than the usual ?all and broadcast the change via email, along with the fact that everyone sending emails through other SMTP servers will have their emails flagged as junk and that it is their responsibility to change it. May 10, 2013 at 21:35
  • (If you're not familiar with SPF records, -all means "don't trust any other entities at all", whereas ?all means "shrug") May 10, 2013 at 21:36

4 Answers 4


This depends on the kind of phishing attacks your users regularly fall victim to. If they fall victim to "please email me your credentials", but not to "click this link", you've got some very weird users.

Otherwise, if they fall to both, or if they just fall to crafted links, you can set a local server up and set a phishing site up. This will guarantee that no credentials leave your network, while still allowing the ultimate goal: to figure out who fell for it. This also means that you are a bit more in control as everything happens locally.

However, there are a couple of points that raised an eyebrow:

  • If some of your users use an external SMTP server, it means that down the line, you either have no SPF record for the domain where the mailboxes are, or you have an overly permissive SPF record. This is a major issue as it makes phishing emails trivial to craft in order to look "good" - all a phisher needs to find is an open relay. Consider adding a restrictive SPF record and telling your users to use your SMTP server (+ TLS or GTFO)
  • Why do you want to shame your users? Drawing statistics is a much better use of the data. Naming & shaming leads to people being singled out over something relatively trivial (or a mistake we could all make), leads to people leaving for greener pastures.

Don't shame your users. Shame is easily ignored. To be effective, you have to retaliate on your users. If they succumb to the fake phishing, beat them up, whip them, then fire them. Also, ask for their credit card number or bank details in the phishing email, and plunder the accounts of the misguided users who fell to it. Be sure to upload child pornography pictures in their desktop systems, too, and then denounce them to the FBI. Remember that a good user is a disgruntled user, quaking with fear, full of resentment and on the verge of the nervous breakdown. Only then will he be productive and efficient.


Sarcasm notwithstanding, shaming your own users through a fake phishing, besides being morally dubious and also illegal in most countries, also looks like a bloody stupid thing to do in the first place.

If you are really intent in playing the attacker's role then you will have to operate as successful attackers do -- which will entail associating with fishy individuals such as botnet operators, who sell mass-email sending services to spammers.

  • I do not like the idea at all. I am hoping to convince them otherwise. The legality argument is one I didn't think about. I'll bring that up. May 10, 2013 at 16:35
  • Disagree with the last paragraph. While phishers generally do use botnets, etc to send their messages you could send them from TempDomainForTheBossesReallyReallyBadIdea.com using servers you control, but not from a domain that ever should be sending that sort of message instead. May 10, 2013 at 20:49

To me this idea looks more of a pandora box:
- Put aside good intentions, it is entrapment/enticing that may end up in a court (unless you are some kind of gov/regulated entity where you have it covered). e.g. the user can claim that his bank account was emptied exactly after this 'antiphishing campaign' of yours;
- It will confuse users beyond repair - you do the test, they take the bite, you get back to them with 'shame on you', they will subconsciously jot down this as 'Ah,if it is a phishing mail then it is from our IT guys', then the real phishing attempt comes with smart wording 'e.g. Hello, this your IT dep doing the check on recent accounts breach, please click...'


The only way I would possibly consider approaching this if asked would be to send a good looking e-mail from a unofficial server that would link to a non-standard URL and registered under a third party, but still connected to a non-commonly used IP on servers that were controlled by the correct organization.

This way, people who fall victim to it do not compromise any information and can instead be worked with to explain what phishing is and how to best avoid it. I also wouldn't try to shame them. I likely wouldn't even make it obvious that they fell for a phishing attack at the time they connect, but rather have customer service call them and talk with them about it.

The only way it is going to be well received is if every step of the process protects their information and it is approached as an education service to help them as opposed to a "test". If they perceive it as a test, it's going to get more resentment than providing a helpful, educational service.

Another way to do it might be to simply send out the e-mail from the fake e-mail address and actually disclose that it is a phishing e-mail in the e-mail itself and explain some of what they should look for in a real message right in the fake message you send out. It's far easier to implement and probably will be better received and equally effective.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.