It is time to stop the blaming and shaming of phishing victims. Granted, end users should know better than to click on random attachments, but crooks are getting better at crafting clever emails that can fool even experienced professionals. And that’s just half the problem.

Phishing Scams Becoming Harder to Spot

While professional phishing messages are improving in quality and are often indistinguishable from legitimate email, there is another issue: Since more users are checking their emails on mobile devices with smaller screens, phishing emails are getting even harder to spot.

Take the case of one phished email that brings up a site that appears very close to the Google Account page. It displays the following in a victim’s browser bar:


Image Source: Wordfence

Note that the URL is preceded by a “data:text” label. This isn’t an ordinary URL, but a data URI, which enables a complete file to reside in the browser location bar. It is a clever way to embed a script without showing it. Wordfence warned users to carefully observe the browser bar and ensure that there isn’t anything preceding the HTTPS protocol phrase.

Shaming Phishing Victims Is Counterproductive

Shaming users for falling victim to one of these tricky phishing schemes is counterproductive because it creates a negative and unhelpful environment. Employees don’t want to feel ashamed for failing at their jobs.

“People are afraid of getting in trouble, and the last thing you want is for employees to hide it when they make a mistake,” one security researcher told Lifehacker Australia. Instead, IT leaders should encourage end users to report suspicious emails to the security department and offer rewards and incentives to promote good security practices.

The solution is more education, security awareness training and positive reinforcement. In some companies, IT departments and security operations team may be able to handle creating an ongoing training program catered to organizational needs. However, not all businesses have the resources, knowledge and bandwidth to do this and may instead turn to third parties for help. Many vendors offer these programs — the trick is finding one with a positive focus, such as KnowBe4’s Kevin Mitnick Security Awareness Training, the SANS Institute’s Securing the Human program or Wombat Security’s Anti-Phishing Training Suite.

As long as you eliminate the victim walk of shame from your security strategy, any of these programs can have a big impact.

Listen to the podcast: Take Back Control of Your Cybersecurity Now

More from Fraud Protection

Remote access detection in 2023: Unmasking invisible fraud

3 min read - In the ever-evolving fraud landscape, fraudsters have shifted their tactics from using third-party devices to on-device fraud. Now, users face the rising threat of fraud involving remote access tools (RATs), while banks and fraud detection vendors struggle with new challenges in detecting this invisible threat. Let’s examine the modus operandi of fraudsters, prevalence rates across different regions, classic detection methods and Trusteer’s innovative approach to RAT detection through behavioral analysis. A rising threat As Fraud detection methods become more and…

Gozi strikes again, targeting banks, cryptocurrency and more

3 min read - In the world of cybercrime, malware plays a prominent role. One such malware, Gozi, emerged in 2006 as Gozi CRM, also known as CRM or Papras. Initially offered as a crime-as-a-service (CaaS) platform called 76Service, Gozi quickly gained notoriety for its advanced capabilities. Over time, Gozi underwent a significant transformation and became associated with other malware strains, such as Ursnif (Snifula) and Vawtrak/Neverquest. Now, in a recent campaign, Gozi has set its sights on banks, financial services and cryptocurrency platforms,…

The rise of malicious Chrome extensions targeting Latin America

9 min read - This post was made possible through the research contributions provided by Amir Gendler and Michael  Gal. In its latest research, IBM Security Lab has observed a noticeable increase in campaigns related to malicious Chrome extensions, targeting  Latin America with a focus on financial institutions, booking sites, and instant messaging. This trend is particularly concerning considering Chrome is one of the most widely used web browsers globally, with a market share of over 80% using the Chromium engine. As such, malicious…

What to do about the rise of financial fraud

6 min read - As our lives become increasingly digital, threat actors gain even more avenues of attack. With the average person spending about 400 minutes online, many scammers enjoy a heyday. Old impersonation scams continue to deceive people every day, as con artists and hackers are armed with advanced technologies and sophisticated social engineering tactics. According to the Federal Trade Commission, financial fraud increased by over 30% from 2021 to 2022, with total losses surpassing $8.8 billion. This ever-evolving threat will continue to…