At what point do you make the example ?

For the first instance I would handle it privately and individually with all involved. Afterwards I would send out an organization-wide email describing what happened and how to not fall prey to it (with edited screenshots, if necessary) but not mention names.

If it happens again after that though, anyone involved gets to become an example.

Example: Years back when "Your Windows Anti-Virus is expired" messages were king we had a user who -instead of calling IT immediately- pulled out his PERSONAL card and charged a "renewal" to it.

We informed him of what he had done, what he should have done, etc. then sent out an email (with screenshots of the email he had received) to everyone in the organization. Not only did it not happen again, it started a theme of people calling us if something looked questionable (which I would rather than having to backup, wipe, reimage, etc. systems).


Another example (in a slightly different vein): we have someone in one of the purchasing units who will eventually re-forget how to order new computers so she will mail the requests in (yes, through the postal service). She has our Dell rep's contact info and has ordered through them multiple times over each year for at least a decade but every now and then she just regresses.

The last time it happened she got a very loud and public shaming at her desk, for all her co-workers to witness. It hasn't happened again since then (and that was 2-3 years ago).