I've tried to get this through to companies like, for instance, my bank, with little success.

Before I finally managed to "opt out" of the last of their marketing / promotional email, I would get two kinds of messages from them:

1) Regular reminders of secure practice, and how you can't trust who an email comes from, and you should therefore never, ever click a link in an email claiming to be from them.

2) Constant spam for their products and services, all replete with links to follow to get them. These mails all came through outside agencies, from Mailchimp or similar, and with all the links going through a click tracker in some random advertising company's domain.

I couldn't even get their two departments to talk to each other about this.

I sent it to our security folks (it's a big company), and they said, "If it isn't marked "External" it's safe. Uh, where were you in 2010 when our email servers were being run by the Chinese MSS?

Or Microsoft which thinks a single Teams workflow should have a user connect to teams.microsoft.com, my.sharepoint.com, planner.cloud.microsoft, and login.microsoftonline.com and hope users will still notice a lookalike phishing domain.

If you use third party services for surveys, marketing etc, and you tell customers that yes, they are legitimate, not to worry. What's stopping a scammer from copying these emails and sending them from servicenames similar to the legitimate third party vendor?

I choose to read this as we need to have more courses in how to _send_ phishing mails and I just want to say that I'm a professional ethical hacker and I support this message

I've seen even *password reset* mail come from the great elsewhere, and of course arriving long after any timeout.

But apparently even those deliveries succeed often enough that the misconfigurations persist.

At the cost, in most cases, of me not continuing to be their customer or member.

Right now I'm confident the survey from a partner of Uber (which triggered this rant) is legit. But given nothing links to uber, what's to stop a scammer from copying it wholesale? It's the kind of thing that is ripe for scammers to use

Like... what? That's exactly the way any scammer would do it. And it's exactly what I told my parents to be aware of.

It's like holding a masked ball, and then complaining that people didn't watch each others faces.

They were explained that this looked very much like phishing and please could they tell how we should know.

After that there was usually an email from the mgmt which said that yes, the next phising email is not phishing.

But I still think that was a bad solution.

2/2

So, after a strict reminder not to click on suspicious links in emails, check domains &c, we got this email for registering for a company party. It was from a third party company, the email came from their domain. The registration link was an another domain. Of course our company was only mentioned in the text.

1/2

No, having the correct company domain does not show that an email isn't a scam.

But sending from a domain clearly not related to the company IS an obvious sign of a scam.

Positive vs negative verification.

Unfortunately, "make it look like a scam" is on page one of every book on corporate "best practices".