Ask HN: Should Banks Phish Their Own Customers

That's a really good point, and its a tough needle to thread.

So my train-of-thought goes something like: If my customers are going to get hacked, its better they get hacked by my good-guys than actual criminals. If they're more suspicious about clicking on links from my bank (or links that LOOK like they're from my bank) - it isn't necessarily a bad thing.

Running managed phishing campaigns against your internal staff erodes trust too. It’s a widely implemented practice but I’ve never seen evidence that it actually improves security or whether the negative impacts of trying to trick your own staff are actually worth the tradeoff. My sense is it’s really only useful for measuring how porous your organization is to phishing to decide how to invest in training/other security efforts.

I suppose with internal users you can theoretically target test-failures for individual training or performance intervention - for customers you can’t do that.

This. If my bank contacts me I want it to be legitimate and honest. If I started getting phishing attempts I'd start ignoring my banks contact attempts completely. So when someone skims my card, makes some purchases and they try to ask me about it, I'll ignore them. Not good.

Do they still teach home economics in school?

If I received an email with a URL looking like yours, I'd NEVER click it.

The idea is to preemptively 'harden' your customers against real phishing attacks by exposing them to controlled, simulated ones. By increasing their wariness and increasing their suspicion of fraudulent communications, you're trying to inoculate them against actual threats.

To provided educational materials to your customers, and hopefully drive down fraud related expenses.

The same thing? I'm guessing there is a large number of non-tech employees that are bank customers. Sure, tech jobs might "train" their employees about phishing. I highly doubt the employees in the construction, automotive, service industry, retail, or any of the other than tech industries do any kind of anti-phishing training.

I can sympathize with a bank wanting to at least offer some sort of anti-phishing something to their customers. After all, it is the bank that has to deal with it when things go wrong. They have already started some customer education attempts with "we will never call you" type of things. This could just be the next step in that.

Banks keep all sorts of metrics on customers, to approve or deny transactions. If someone types their password into bank .ru/phishy.php and never changes their password afterward, that's useful information. If they then try to buy $10,000 of bitcoin in coinbase, the bank algorithm should probably deny it or require more verification steps. I'm not saying this practice is good, but I get it. Also, banks share the same technology like chexsystems, who could use A/B testing for research. It's cheaper than focus groups. For example, if A/B tests show requiring customers to submit their username first, then on the next page it says "Hi Bill! Great day in San Francisco! Enter your password: " causes them to notice the url bar isnt chase.com, thats good tangible info that will save banks from losing customer money.

I've experienced first-hand, that banks have a sort of "paranoia level" value for each customer account.

I've reported my ATM card phished+stolen before. I took money out from an ATM in a bodega in a bad part of town (where the thief was apparently watching me input my PIN through the window); and then, when I stepped outside, the thief mugged me for the ATM card.

Luckily, they only got ~$1000 from the account (= my daily withdrawal limit at the time); and the bank reimbursed me for this.

Annoyingly, to get the bank to do that, I had to file a police report, and give them the investigation number.

I also (obviously) had to change my PIN.

Ever since then, though, my ATM card will no longer work at bodega ATMs in this bad part of town. (I worked in the area at the time, so this was easy to notice.) It also doesn't work for the PoS systems in the bodegas themselves! However, it still works fine in ATMs at real banks in the bad part of town; and at ATMs / PoS systems in other, less-sketchy parts of town.

My belief is that, once my bank had to pay out an theft-insurance claim for the account, they labelled me in their internal systems as "at high risk of being a victim of future theft" (a.k.a. an "easy mark") — and this then bumped up my account's "paranoia level" to protect against future theft. So now, my bank, when being asked to authorize any ATM transaction, will reject the transaction if the business making the request has ever been associated in their systems with fraud/theft claims (even as an intermediary); or if the business has a high rate of refunds; or doesn't have enough history; etc.

In other words, the bank seems to internally assign businesses a kind of "credit score" for authorizing transactions; and a transaction is only authorized if the business's "credit score" exceeds the customer account's "safety threshold." My safety threshold was increased, so low-credit-score businesses can no longer interact with me through the bank.

---

It should be clear what I'm getting at here: failing an internal-red-team phishing test, should bump up a given customer's accounts' fraud-risk safety threshold.

A bank could add security drills into the contract with the customer. It's a kind of training so it could also get some good press.

Add some credits (maybe real money) if a customer reports correctly the phishing to the bank instead of ignoring it or falling for it? The downside could be a lot of pressure on the security related part of customer service so they should plan to get only a few reports per day.

This is what I had in mind.

Bank.com hires pen-testers to trick people to go to Bank.evil, spill their ID/Password/OTP.

The bank doesn't have to send the simulated phishing emails from their own domain. Actually I don't think they'll want to do it as it would lower the spam reputation of their domains. They should use shady domains like every real phisher.

i completely disagree, its definitely educational to people in demographics who fall for these things. and its less denigrating than the real thing.

and the dummy skimmers on gas pumps isn't a bad idea, there's a lot of people who have probably still never heard of them, although maybe videos would reach a wider audience for this one as having this irl could cause actual problems. whereas fake phishing emails to vulnerable customers will force them to wisen up.

even if its something that shouldn't need to be implemented at your bank, because there are better solutions, it can still help them elsewhere in life.

What infra security prevents your customer from typing their password and TOTP code into someone else's website?

One way to do this right is to do trainings first, inform employees about future campaigns, and to only ever use reports from phishing campaigns in the aggregate to improve the training.

You will never be able to block 100% of legit phishing attempts, your employee alertness is another layer of defence.

I've seen an interesting trend at multiple companies. The security team starts sending phishing emails to the employees and if you get phished you have take a training. Simultaneously, HR and executives send company wide emails from third party domains because security won't let them setup email tools on the main domain. As a result, employees start reporting HR and executive emails as phishing and lots of corporate communication breaks down.

> hardware keys (FIDO2)

and how would they work with smartphones, as banks a increasingly making them first-class banking clients?

In addition to phone, also providing an accurate list of all other domains owned by the bank, all other domains used for legitimate emails, and all social media accounts.

I would add

* ability to confirm email validity by logging into my bank and seeing same email in their communication queue with me

My bank sends me emails, and I have no way to confirm that the bank really sent them.

> don't trust anything on a different domain

Then you receive an email from your "securebank.com"

from: "securebank-communications.com"

title: "Beware of fraudsters sending emails and text messages"

body: "Tap here to install our latest secure mobile app"

I'd rather prefer banks don't trim passwords implicitly and don't force clients to use their lousy apps working only with the latest mobile OS's and immediately invalidating any previous versions of their lousy mobile apps.