Time to Stop Shaming Phishing Victims

It is time to stop the blaming and shaming of phishing victims. Granted, end users should know better than to click on random attachments, but crooks are getting better at crafting clever emails that can fool even experienced professionals. And that’s just half the problem.

Phishing Scams Becoming Harder to Spot

While professional phishing messages are improving in quality and are often indistinguishable from legitimate email, there is another issue: Since more users are checking their emails on mobile devices with smaller screens, phishing emails are getting even harder to spot.

Take the case of one phished email that brings up a site that appears very close to the Google Account page. It displays the following in a victim’s browser bar:

Time to End Phishing Victim Shaming
Image Source: Wordfence

Note that the URL is preceded by a “data:text” label. This isn’t an ordinary URL, but a data URI, which enables a complete file to reside in the browser location bar. It is a clever way to embed a script without showing it. Wordfence warned users to carefully observe the browser bar and ensure that there isn’t anything preceding the HTTPS protocol phrase.

Shaming Phishing Victims Is Counterproductive

Shaming users for falling victim to one of these tricky phishing schemes is counterproductive because it creates a negative and unhelpful environment. Employees don’t want to feel ashamed for failing at their jobs.

“People are afraid of getting in trouble, and the last thing you want is for employees to hide it when they make a mistake,” one security researcher told Lifehacker Australia. Instead, IT leaders should encourage end users to report suspicious emails to the security department and offer rewards and incentives to promote good security practices.

The solution is more education, security awareness training and positive reinforcement. In some companies, IT departments and security operations team may be able to handle creating an ongoing training program catered to organizational needs. However, not all businesses have the resources, knowledge and bandwidth to do this and may instead turn to third parties for help. Many vendors offer these programs — the trick is finding one with a positive focus, such as KnowBe4’s Kevin Mitnick Security Awareness Training, the SANS Institute’s Securing the Human program or Wombat Security’s Anti-Phishing Training Suite.

As long as you eliminate the victim walk of shame from your security strategy, any of these programs can have a big impact.

Listen to the podcast: Take Back Control of Your Cybersecurity Now

Share this Article:
David Strom

Security Evangelist

David is an award-winning writer, speaker, editor, video blogger, and online communications professional who also advises numerous startup and well-established technology ventures. He began his career as an in-house IT analyst and has founded numerous technology print and online publications, such as editor-in-chief of Network Computing magazine and as part of the launch team of PC Week's Connectivity section. David has written two books and spoken around the world at various conferences and been on national radio and television talking about network technologies. He continues to build websites and publish articles on a wide variety of technology topics geared towards networking, security, channel, PC enthusiasts, OEMs, and consumers. In addition to these activities, he consults to vendors and evaluates emerging technologies, products, strategies, and trends to help position and improve their technology products.