A rant about phishing: It's not the user's fault (and not DNS either)

IT department: ”A clear telltale sign of phishing is the sense of urgency. Official IT department email will never panic you into clicking strange links”

Also IT department: ”YOUR PASSWORD IS EXPIRING IN 24 HOURS!!! CLICK THIS STRANGE LINK NOW TO RESET YOUR PASSWORD!!!”

Exactly right. And the reasoning here is that the IT department is in no rush because they don’t care if your password expires, so what.

At some point the password will fail to work and you’ll be prompted to pick a new one. Either you’ll update it and log in, or you won’t, IT doesn’t care.