Running a Phishing Drill for the Office

Why this matters

The office is where a small shop's money and access move, and the person most likely to let an attacker in is a capable office manager on a busy Tuesday, not a careless one. A quarterly phishing drill, a harmless fake message sent to your own staff, is the cheapest way to find out how your office actually responds before a real one arrives. The point is not to catch anyone. It is to measure two things, how fast someone reports a suspicious message and whether anyone acts on it, and to change your training based on what the drill shows rather than on what you assume.

Before the first drill: four ground rules

Set these once, in writing, and tell the staff. Skipping any of them is how drills turn into resentment and stop working.

Announce the program, not the dates. Tell everyone that test messages will arrive a few times a year, that they will look real, and what to do with anything suspicious. People who know drills exist report more, which is the behavior you want, and they are not embarrassed when they fall for one.

Nobody is punished for clicking. Write it down. A drill that gets someone disciplined teaches the office to hide mistakes, and a real attack is survived by people who say "I think I clicked something" within minutes.

Everyone is drilled, including the owner. An owner who exempts themselves tells the office that the drill is about them and not about the shop. The owner's inbox is also the one attackers want most. See related: The Owner's Personal Accounts Are Business Accounts.

One way to report, and it is easy. A single address or a single button that forwards a message to whoever handles security. If reporting takes more than ten seconds, people decide it is not worth it.

Step 1: Choose the lure, and choose it kindly

A lure is the pretext the test message uses. Rotate through the kinds a trade shop actually receives: an overdue supplier invoice, a shipping or delivery notice, a password reset or "your mailbox is full," a request that looks like it came from the owner, and a message with only a phone number in it (attackers increasingly ask you to call them, because a phone number is harder for filters to catch than a link). See related: Reading a Phishing Email Aimed at a Trade Shop.

Do not use cruel lures. No fake bonuses, layoffs, pay changes, health results or family emergencies. They work, and they damage trust far more than they teach. Do not impersonate a real supplier or bank by name, because staff may call the real company to ask about it and you will have created a real-world mess; invent a plausible lookalike instead.

Why this step matters: a drill that always uses the same lure only measures whether staff recognize last quarter's drill.

Step 2: Build the message and the landing page

Use a phishing simulation service, or do it by hand: send from an outside email address you control, with a link to a simple web page you also control. The page should say plainly "This was a phishing drill. Nothing has happened. Here is what to look for," with three or four tells listed.

If the lure asks for a password, the page must not store anything typed into it. Record only that the form was submitted, never what was entered. A drill page that collects real passwords is itself a security problem, and someone who typed their real password should change it anyway, which the page should tell them.

Here is the message one shop used for its first quarter:

From: Accounts <[email protected]>
Subject: Overdue: statement 88213 - action needed

Hi,

Your account shows an unpaid statement over 30
days. To avoid a hold on your next order, please
review and pay today:

    [ View statement ]

Accounts Receivable

It carries four tells, and the landing page listed them: a sender domain that is not the supplier's real one, a threat attached to a deadline, a greeting with no name, and a link where a real supplier would simply attach the statement.

Step 3: Send it, and pick the moment

Send midweek, mid-morning, on an ordinary day. Not payday, not the first day of a busy season, not the week someone is training a new hire. Send to each person individually so the message does not show a long recipient list, which is itself a tell.

Whoever runs the drill cannot be a test subject that quarter. In a small office, rotate the job between the owner and the office manager, or let a service run it so both can be drilled.

Step 4: Measure the right things

Record four numbers per drill, each against the number of people who received the message:

• Click rate: opened the link, or called the number.
• Submit rate: entered anything on the landing page.
• Report rate: used the reporting route.
• Time to first report: minutes from send to the first report.

Report rate and time to first report matter more than click rate. In a real attack, one person reporting within ten minutes lets the owner warn everyone else, block the sender and check whether anyone clicked. A shop where two people click but someone reports in six minutes is in better shape than one where nobody clicks and nobody reports, because the second office will not notice the real one that gets through.

Be honest about the sample size. In a five-person office drilled four at a time, one person moves any rate by twenty-five points. Read the trend over a year, not a single quarter.

Step 5: Debrief within two business days, without shaming

Gather the office for fifteen minutes. Put the message on screen and walk through the tells one at a time, asking the room to find them before you point them out. Thank the people who reported, by name, if they are comfortable with it. Never name anyone who clicked, in the room or in writing anyone else reads. If someone tells you privately that they clicked, thank them for saying so; that is precisely the behavior a real incident needs.

End with the one question that matters: "If this had been real, what would have happened next, and who would you have told?" The answers usually show the real gap, which is often not the email at all but not knowing who to call.

Step 6: Change the training based on what the drill found

The drill earns its keep here. Look at which tell was missed and aim the next quarter's lure and the next debrief at it. If nobody reported because nobody remembered the address, fix the reporting route. If the owner-impersonation lure worked, practice the second-channel callback. See related: The Verify-on-a-Second-Channel Rule.

Worked example: one office, one year

A garage door company's office had five people: the owner, the office manager, two dispatchers and a part-time bookkeeper. The owner and the office manager took turns running the drill.

Quarter one, overdue supplier invoice (the message above), run by the office manager and sent to the other four: 4 received. 2 clicked, 50 percent. 1 submitted the fake sign-in form, 25 percent. 1 reported, 25 percent. First report at 95 minutes, from the bookkeeper, who had seen a real one at a previous job.

The debrief found the real gap. Both dispatchers who clicked said they had noticed the odd sender address and clicked anyway "to check." Neither knew there was a reporting address. The office set up a single forwarding address and taped it to every monitor.

Quarter two, delivery notice, run by the owner, 4 received (the owner excluded as runner). 1 clicked, 25 percent. 0 submitted. 3 reported, 75 percent. First report at 12 minutes.

Quarter three, a message with only a phone number, run by the office manager, 4 received. 1 called the number, which rang a line the office manager had set up, 25 percent. 3 reported, 75 percent. First report at 6 minutes. The one who called said the lack of a link made it feel safe, so the debrief covered callback phishing specifically.

Quarter four, an urgent request apparently from the owner asking for a payment to a new supplier. Run by a simulation service this time, since the owner was the impersonated sender and the office manager wanted to be tested on it. 4 received (the owner excluded, since the message claimed to come from him). 1 replied asking for the account details, 25 percent. 3 reported, 75 percent, and one of those also phoned the owner on his mobile to check, which is the response the drill was hoping for. First report at 4 minutes.

Reading the year. On four people per quarter, the click rate went from 50 percent to 25 percent and then held at 25 percent for three quarters, one person each time and a different person in each quarter, which says the office is not split into careful and careless people; anyone can be caught by the right lure on the right day. The report rate went from 25 percent to 75 percent and held there. Time to first report fell from 95 minutes to 4. That last number is the one the owner cared about: a real version of the quarter-four message would now be flagged and checked within minutes.

What would have changed the approach. An office where the click rate stayed at 50 percent through the year with reports also flat would need something other than drills, probably a sit-down session on the tells and a hard rule that no payment or bank change happens from an email alone. And a shop where one specific person clicks every quarter should treat it as a coaching conversation in private, and ask whether that person's role (handling every supplier invoice, say) means they face more real lures than anyone else, which changes what support they need.

How to know the drills are working

Two signs, both outside the drills themselves. First, real reports start arriving: staff forward genuine suspicious messages between drills, some false alarms included. That is the behavior working. Second, the debrief answers get specific: by the third or fourth drill, people should be naming the reporting address and the callback rule without prompting. If neither happens within a year, the drills have become a ritual, and the next step is to ask the office directly what would make reporting easier.

References

• See related: Reading a Phishing Email Aimed at a Trade Shop
• See related: Training the Office to Spot Social Engineering Calls
• See related: The Verify-on-a-Second-Channel Rule
• See related: The Gift Card Request From the Boss