It is time to stop the blaming and shaming of phishing victims. Granted, end users should know better than to click on random attachments, but crooks are getting better at crafting clever emails that can fool even experienced professionals. And that’s just half the problem.

Phishing Scams Becoming Harder to Spot

While professional phishing messages are improving in quality and are often indistinguishable from legitimate email, there is another issue: Since more users are checking their emails on mobile devices with smaller screens, phishing emails are getting even harder to spot.

Take the case of one phished email that brings up a site that appears very close to the Google Account page. It displays the following in a victim’s browser bar:


Image Source: Wordfence

Note that the URL is preceded by a “data:text” label. This isn’t an ordinary URL, but a data URI, which enables a complete file to reside in the browser location bar. It is a clever way to embed a script without showing it. Wordfence warned users to carefully observe the browser bar and ensure that there isn’t anything preceding the HTTPS protocol phrase.

Shaming Phishing Victims Is Counterproductive

Shaming users for falling victim to one of these tricky phishing schemes is counterproductive because it creates a negative and unhelpful environment. Employees don’t want to feel ashamed for failing at their jobs.

“People are afraid of getting in trouble, and the last thing you want is for employees to hide it when they make a mistake,” one security researcher told Lifehacker Australia. Instead, IT leaders should encourage end users to report suspicious emails to the security department and offer rewards and incentives to promote good security practices.

The solution is more education, security awareness training and positive reinforcement. In some companies, IT departments and security operations team may be able to handle creating an ongoing training program catered to organizational needs. However, not all businesses have the resources, knowledge and bandwidth to do this and may instead turn to third parties for help. Many vendors offer these programs — the trick is finding one with a positive focus, such as KnowBe4’s Kevin Mitnick Security Awareness Training, the SANS Institute’s Securing the Human program or Wombat Security’s Anti-Phishing Training Suite.

As long as you eliminate the victim walk of shame from your security strategy, any of these programs can have a big impact.

Listen to the podcast: Take Back Control of Your Cybersecurity Now

More from Fraud Protection

New DOJ Team Focuses on Ransomware and Cryptocurrency Crime

While no security officer would rely on this alone, it’s good to know the U.S. Department of Justice is increasing efforts to fight cyber crime. According to a recent address in Munich by Deputy Attorney General Lisa Monaco, new efforts will focus on ransomware and cryptocurrency incidents. This makes sense since the X-Force Threat Intelligence Index 2022 named ransomware as the top attack type in 2021. What exactly is the DOJ doing to improve policing of cryptocurrency and other cyber…

What Are the Biggest Phishing Trends Today?

According to the 2022 X-Force Threat Intelligence Index, phishing was the most common way that cyber criminals got inside an organization. Typically, they do so to launch a much larger attack such as ransomware. The Index also found that phishing was used in 41% of the attacks that X-Force remediated in 2021. That's a 33% increase from 2021. One of the biggest reasons threat actors are increasing phishing attacks is that all it takes is one employee to make a…

Top Security Concerns When Accepting Crypto Payment

From Microsoft to AT&T to Home Depot, more companies are accepting cryptocurrency as a way to pay for products and services. This makes perfect sense as crypto coins are a viable revenue source. Perhaps the time is ripe for businesses to learn how to receive, process and convert crypto payments into fiat currency. Still, many questions remain. How can you safely enable customers to pay with Bitcoin or other digital currency? What are the security risks that come with cryptocurrency? Let’s…

NFT Security Risks: Old Scams and New Tricks

The non-fungible token (NFT) boom has also led to some serious security incidents. For example, the number of suspicious-looking domain registrations with names of NFT stores increased nearly 300% in March 2021. To participate in an NFT marketplace, you must have an active cryptocurrency wallet. This exposes NFT holders to new risks as attackers can find ways into your crypto wallet through your marketplace account. As we’ll see, threat actors have even infiltrated NFT marketplace OpenSea’s Discord server posing as…