Thousands of university students and employees targeted by email phishing schemes this year have taken the bait. Fortunately, they were duped not by real scammers, but by their own schools - in simulations meant to make them more adept at spotting real threats.
When Ohio State University did its first student-focused phishing in January - a strategy also used in the corporate world - over 18 percent of the recipients clicked through. The University of Alabama at Birmingham's employee-focused phishing awareness campaign snagged over 7,000 people in March, or about a quarter of the recipients.
"I was sort of like, 'Wow, I'm really, really bad,'" Herrera, 19, said with a smile. Since then, he said, he has become more cautious while scrolling through emails from unfamiliar senders.
"A phishing simulation helps people understand the role that they play in managing security - that it's not up to their IT support or the help desk or whoever that they can sort of blindly walk along," said Helen Patton, Ohio State's chief information security officer. "A lot of what makes an organization secure is what happens between an individual and their keyboard or their phone."
Just last month, U.S. prosecutors accused a group of Iranians of hacking the computer systems of about 320 universities in the U.S. and abroad to steal billions of dollars' worth of science and engineering research that was then used by the government or sold for profit. Prosecutors said spear-phishing emails were used to target over 100,000 professors, but they didn't publicly identify those individuals or their schools.
Ohio State has used phishing simulations for employees since 2016. Officials won't disclose exact results for security reasons but say responses have improved since the early rounds when, for example, a message about a second-floor printer was clicked by people in facilities that didn't even have a second floor.
The risk, of course, is that folks will feel tricked, so it's important that the training be educational, not punitive, Grama said.
At Alabama-Birmingham, one faculty member decried the phishing simulation as a waste of time, but most responses were positive, said Curt Carver, the university's vice president for information technology, who recalls first hearing about the concept of self-phishing over a decade ago.
Some people report the messages as suspicious, and others send replies like "Ha, you got me!" or "Didn't get me this time!" A few, he said, expressed interest in making it more of a game, wanting to gauge how well they detect phishing attacks compared with others.
"They've realized ... they can be a hero, they can be a person that helps protect everybody else," Carver said.