A message about phishing training can be a real workplace test or a scam that copies one to steal your password. The name alone does not tell you which.
An email, text or chat message about "phishing training" may be a real test from your employer or school. It may also be a scam that borrows the idea. The name on the message does not prove either one.
Many organizations run this kind of training. Microsoft's Attack simulation training, part of Defender for Office 365, sends "realistic but harmless" fake scam emails. It then assigns training based on what each person does. An administrator can also assign training with no test at all, so a real message may contain no trap.
A criminal can copy the look. The message might demand "mandatory phishing training" by a deadline and link to a page that asks for your work or school password. No public report of a named campaign like this turned up, so this is a pattern, not a known gang. How common it is remains unknown.
If you have not clicked anything or typed a password, you have lost nothing. Treat the message as unconfirmed and go to your organization's training site yourself. The risk is highest for anyone with a work, school or club email.
The alert box above lists the steps. The key rule: never use the link in the message, and do not call a number in it to check it. Ask your IT team using a number or address you already had. A friendly, official look proves nothing either way.
Never trust the link in a training message. Open the training site yourself and confirm with IT using contact details you already have.
The Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone callsScammers are posing as Texas sheriff's officers and claiming you missed jury duty. Caller ID can show a real police number even when the call is fake.
Read more: Fake jury duty calls spoof a real Texas sheriff's phone numberFake PayPal emails and texts, some posing as a security report, try to get you to tap a link and type your login. Checking your account directly avoids the trap.
Read more: Got a fake PayPal message? Skip its link and check your account yourself
