I don't get why all these big companies just cannot be serious about anything they do. They're always disorganized.

The mentality around online security now is to push the responsibility onto someone else instead of investing any real effort into it. So you need to be aware of phishing scams, but the company isn't going to make any kind of effort towards it. That's on you, not on us!

Microsoft is really terrible about this. They have at least 20 different domains and many of them ask you to enter your credentials into them. Usually you're redirected to something like login.microsoft-online.com or something like that and enter in your credentials into that. Always seems like a phishing thing... why wouldn't it just be login.microsoft.com? I'm guessing within Microsoft, it's probably was a pain in the ass to get whatever department in MS that controls the microsoft.com domain to set up a subdomain. So instead ever department registers a domain that they can control. The end result is you're dumping your credentials into random looking domains, then downloading and installing software from other random domains.

They just don't really care as long as there's no legal liability. You're data gets compromised because you didn't notice that you put your credentials into online.microsoft-login.com instead of login.microsoft-online.com, that's your mistake and no one can sue microsoft for it. As long their negligence doesn't meet the legal definition of negligence, they're not going to put an any kind of effort.

Anti-phishing training could be so much better... "don't put your credentials into anything other that *.microsoft.com". But since these companies won't make any effort, anti-phishing training amounts to "Just be careful or whatever LOL!"

A competent government would set up best practice rules, and tools to improve systems. They could even provide some sort of system for consumers to report these issues. Then they could assign companies a cyber security score. Basically, a wall of shame for this stuff, ideally with the option for fines for non-compliance.

Unfortunately, "competent government" seems to be an oxymoron in most places.

Edit: to be clear, I provided examples of half-hearted implementations of what I'm talking about from a couple sources, but I'm making no claims about the competency of those governments.

Capital One does something similar and it's so fucking annoying. They send text messages that read "Your transaction for some company was DECLINED! Take action now: http://someweirddomain.com/sketchy/uri"

I used URL Checker to figure out where it ultimately landed and it does go to Capital One.

I've even complained about this and they said, "Well, you should know these texts only come from us."

Yeah. Recently I was expecting a message from a bank, finally I got a call... from a chatbot claiming it has an important message for me, but first I have to give it my private info to verify myself and there's no way to validate the call is legit first.

When I complained to the bank they just told me I shouldn't worry, they made the call so it's perfectly safe and there's nothing to worry about...

So many legitimate messages look like phishing schemes nowadays: those class-action ones are probably the worst offenders for me because it would take no effort for someone to create a scam based on that. Banks are another big one. These companies are making it really easy for the scammers to take advantage of people.

With how much effort is being put into phishing awareness and training, some people/companies still put zero effort into their communication.

Duting a lengthy process that involved an attorney, I got an email from a firstnamelastname(at)yahoo(dot)com, with no introduction, no mention of my name, a misspelled address, telling me about an appointment at another address that was... screenshotted from a website and pasted as image. Looks sketchy AF by any measure. Nope, that was a real email from a paralegal.

Filed a helpdesk ticket at work. Get a Teams message from " (external)", asking me my company machine ID in bad English. Responded with "you are helpdesk, do you not know this?". After a few repeated requests for the ID and not answering any of my questions, I just stopped responding.

Is this for real? I would’ve automatically deleted and reported it as spam lol.

I usually post the article in the comments so it is easier to read, but Troy hunt 's website is already so easy to read its a joy!

This is definitely not the reason I do it, but it's an added advantage of always getting packages delivered to my AusPost parcel locker. They always arrive in a very consistent format and don't require clicking any links.

One cool thing that just went live in the last month or so is SMS Sender ID. You need to file a shitton of paperwork before being given the keys to send an SMS to an Australian with a name instead of a phone number.

https://www.acma.gov.au/sms-sender-id-register

I personally had to write the code to make this work for a rather large financial institution that uses AWS for bulk SMS. It was a lot of hoops to jump through. If you get one detail wrong, your SMS just has a phone number instead of a name.

At this point, it should be impossble to deceptively get "Fedex" into an SMS header.