It is time to stop the blaming and shaming of phishing victims. Granted, end users should know better than to click on random attachments, but crooks are getting better at crafting clever emails that can fool even experienced professionals. And that’s just half the problem.

Phishing Scams Becoming Harder to Spot

While professional phishing messages are improving in quality and are often indistinguishable from legitimate email, there is another issue: Since more users are checking their emails on mobile devices with smaller screens, phishing emails are getting even harder to spot.

Take the case of one phished email that brings up a site that appears very close to the Google Account page. It displays the following in a victim’s browser bar:

Image Source: Wordfence

Note that the URL is preceded by a “data:text” label. This isn’t an ordinary URL, but a data URI, which enables a complete file to reside in the browser location bar. It is a clever way to embed a script without showing it. Wordfence warned users to carefully observe the browser bar and ensure that there isn’t anything preceding the HTTPS protocol phrase.

Shaming Phishing Victims Is Counterproductive

Shaming users for falling victim to one of these tricky phishing schemes is counterproductive because it creates a negative and unhelpful environment. Employees don’t want to feel ashamed for failing at their jobs.

“People are afraid of getting in trouble, and the last thing you want is for employees to hide it when they make a mistake,” one security researcher told Lifehacker Australia. Instead, IT leaders should encourage end users to report suspicious emails to the security department and offer rewards and incentives to promote good security practices.

The solution is more education, security awareness training and positive reinforcement. In some companies, IT departments and security operations team may be able to handle creating an ongoing training program catered to organizational needs. However, not all businesses have the resources, knowledge and bandwidth to do this and may instead turn to third parties for help. Many vendors offer these programs — the trick is finding one with a positive focus, such as KnowBe4’s Kevin Mitnick Security Awareness Training, the SANS Institute’s Securing the Human program or Wombat Security’s Anti-Phishing Training Suite.

As long as you eliminate the victim walk of shame from your security strategy, any of these programs can have a big impact.

Listen to the podcast: Take Back Control of Your Cybersecurity Now