text: Q:
  
  Technical security issues with proactively executing a phishing campaign targeting your own users
  
  We've had some issues with compromised accounts due to users falling victim to phishing campaigns.
  The possibility of us doing a phishing campaign against our own users to proactively shame them has come up.
  Putting aside my personal issues with this, I have some security-related problems:
  
  If we use an outside account as the source of the campaign:
  
  Account could be locked by the outside provider---and rightfully so. We will never see the replies anyway.
  Replies will be transported via external servers. These replies may contain credentials.
  
  If we use an internal account as the source:
  
  Some users use external SMTP (they shouldn't, but some do). Therefore, still the chance that the reply is transported via a server we do not manage.
  It will make the message look "more legitimate" since it originates from our domain. Maybe not a fair test?
  
  My question: Has anyone done this? How did you overcome the technical issues? Any issues you didn't foresee? I am hoping to convince management that this is not a smart thing to do but I want to be prepared just in case.
  
  A:
  
  This depends on the kind of phishing attacks your users regularly fall victim to. If they fall victim to "please email me your credentials", but not to "click this link", you've got some very weird users.
  Otherwise, if they fall to both, or if they just fall to crafted links, you can set a local server up and set a phishing site up. This will guarantee that no credentials leave your network, while still allowing the ultimate goal: to figure out who fell for it. This also means that you are a bit more in control as everything happens locally.
  However, there are a couple of points that raised an eyebrow:
  
  If some of your users use an external SMTP server, it means that down the line, you either have no SPF record for the domain where the mailboxes are, or you have an overly permissive SPF record. This is a major issue as it makes phishing emails trivial to craft in order to look "good" - all a phisher needs to find is an open relay. Consider adding a restrictive SPF record and telling your users to use your SMTP server (+ TLS or GTFO)
  Why do you want to shame your users? Drawing statistics is a much better use of the data. Naming & shaming leads to people being singled out over something relatively trivial (or a mistake we could all make), leads to people leaving for greener pastures.
  
  A:
  
  Don't shame your users. Shame is easily ignored. To be effective, you have to retaliate on your users. If they succumb to the fake phishing, beat them up, whip them, then fire them. Also, ask for their credit card number or bank details in the phishing email, and plunder the accounts of the misguided users who fell to it. Be sure to upload child pornography pictures in their desktop systems, too, and then denounce them to the FBI. Remember that a good user is a disgruntled user, quaking with fear, full of resentment and on the verge of the nervous breakdown. Only then will he be productive and efficient.
  ...
  Sarcasm notwithstanding, shaming your own users through a fake phishing, besides being morally dubious and also illegal in most countries, also looks like a bloody stupid thing to do in the first place.
  If you are really intent in playing the attacker's role then you will have to operate as successful attackers do -- which will entail associating with fishy individuals such as botnet operators, who sell mass-email sending services to spammers.
  
  A:
  
  To me this idea looks more of a pandora box:
  - Put aside good intentions, it is entrapment/enticing that may end up in a court (unless you are some kind of gov/regulated entity where you have it covered). e.g. the user can claim that his bank account was emptied exactly after this 'antiphishing campaign' of yours;
  - It will confuse users beyond repair - you do the test, they take the bite, you get back to them with 'shame on you', they will subconsciously jot down this as 'Ah,if it is a phishing mail then it is from our IT guys', then the real phishing attempt comes with smart wording 'e.g. Hello, this your IT dep doing the check on recent accounts breach, please click...' 
  
  