How One Bad Phishing Simulation Can Wreck Company Culture

Why can a phishing simulation hurt company culture?

A phishing simulation hurts culture when it uses something employees need, like a bonus, a raise or job security, to get the click and then treats the click as a failure. People feel deceived by their own employer, trust drops, and they become less likely to report real phishing. Good simulations copy what attackers send and reward the report.

Two well-known cases show how fast this goes wrong. Both companies meant to build phishing awareness. Both ended up apologizing to their staff.

Real examples of phishing simulations that backfired

GoDaddy: the fake holiday bonus (December 2020)

GoDaddy sent employees an email that looked like a company announcement: a one-time holiday bonus of $650, claimed by filling out a form. Employees who clicked were later told the email was a security exercise, that they had failed, and that they would need to complete more security training.

The timing made it worse. It landed at the end of a hard year, when a bonus felt real and needed. Employees spoke to reporters, the story spread nationally, and GoDaddy apologized. The lesson employees took away was not how to spot phishing. It was that their employer would use their hopes against them.

Tribune Publishing: bonuses after layoffs (September 2020)

Tribune Publishing sent newsroom staff an email promising bonuses months after pay cuts and layoffs. When people clicked, they learned it was a phishing exercise. Staff and their union criticized it publicly, and the company apologized.

Same pattern, same result: a message built on a real financial need, sent from inside the company, followed by a message that the employee had failed.

What these simulations got wrong

• They promised money employees were counting on. Bonuses, raises and pay changes are personal. Faking them reads as a betrayal, not a lesson.
• They came from the employer, not an attacker. Real phishing impersonates delivery companies, banks, software vendors and coworkers. A fake HR bonus mostly teaches people to distrust HR.
• They treated a click as a verdict. Telling people they failed puts them on the defensive. People who feel judged hide mistakes instead of reporting them.
• They gave nothing back for doing the right thing. The employees who spotted the email and reported it got no recognition, which is the behavior a program should grow.

Which phishing simulation templates should you avoid?

Skip any template that turns a real hardship or a promise from the company into the reason to click. That includes:

• Bonuses, raises, pay corrections or new benefits from your own company
• Layoffs, restructuring or benefit cuts
• Health emergencies, deaths, or real disasters and tragedies in the news
• Anything that would embarrass people if it were read aloud, such as legal trouble or discipline

Attackers do use some of these themes. You can still teach them in training videos and in a library of real phishing examples, where people can study the red flags without feeling set up by their employer.

How to run phishing simulations that build trust

1. Tell employees simulations happen. Announcing the program does not make it less effective. It makes the point: anyone can be targeted, and reporting is the goal.
2. Copy what attackers really send. Delivery notices, account alerts, shared documents and fake invoice emails teach the patterns people will meet in their inbox.
3. Teach at the moment of the click. Show the red flags right away, in a short, friendly lesson. Then let people move on with their day.
4. Reward the report. Thank every employee who reports a suspicious email, real or simulated. Reporting is the habit that stops real attacks.
5. Never punish a click. See what to do, and not do, when an employee clicks and why punishment backfires.
6. Measure reporting, not just clicks. A rising reporting rate shows a culture that is working. Here is how to measure whether training is working.

Pace matters too. Running simulations on a steady rhythm keeps them routine rather than dramatic; this guide covers how often to run phishing simulations.

Frequently asked questions

Is it ethical to send a fake bonus phishing email to employees?

Most security leaders say no. A fake bonus uses a real financial need to get a click and comes from the employer itself, so it damages trust more than it teaches. Use templates that copy outside attackers instead.

What happened with the GoDaddy phishing test?

In December 2020 GoDaddy emailed staff about a $650 holiday bonus that turned out to be a phishing exercise. Employees who clicked were told they failed and needed more training. After public criticism, the company apologized.

Should employees be punished for clicking a phishing simulation?

No. Punishment teaches people to hide mistakes and stop reporting. Show the red flags right away, keep it short, and thank the people who report.

What should a phishing simulation teach?

It should build one habit: pause, check the sender and the link, and report anything suspicious. A good simulation looks like a real attack, ends with a short lesson, and makes reporting easy.

Keep reading

• Phishing email examples: real attacks with the red flags marked up.
• Should you punish employees who fail phishing simulations?
• How to train employees on phishing awareness