I'm a reasonably well paid software engineer in Silicon Valley, but I don't get a bonus or options of any kind. I suppose my employer to could take vacation days from me or not give me a raise next year, but if they did either of those things because I "failed" a phishing test (where "fail" doesn't even involve giving up any credentials) I would probably be looking for a new job anyway so they might as well fire me.
Forgone bonus was just an example. It could be any sort of penalty or loss of perk, and my question is directed at the stead state equilibrium of the job market, not at behavior given whatever contracts are currently signed. E.g., instead of offering someone $85k, offer them $84k plus a $1k bonus if they avoid phishing attacks. Or give a bonus vacation day to each employee who passes the test. Etc.
I'm pretty sure something like phone banks (in or out-bound) are filled with low-skill workers whose credentials would be valuable to data thieves.
I've worked low wage jobs for the Government and Private Industry where we were hit with ransomware and phishing attacks. I think you are underestimating how many workers are really in that position. I'm not sure if you're American, but it's very common in America.
I claim: Out of the fraction of jobs that fit the description you gave, fewer than half are realistic targets to phishing. Of the fraction of jobs that are realistic targets to phishing, fewer than half fit the description you gave. That's more than is necessary to make my question relevant.
