Business process controls can beat perfect phishing detection
You cannot detect your way out of payment fraud, and you can design your way out of most of it.
A rule that bank details never change without a callback, or that payments above a threshold need two people, works regardless of how convincing the message was. It does not depend on anybody spotting anything, which is why it outperforms every awareness campaign ever run.
More on Human factors
- Phishing exploits context, not stupidityIt fitted the gap
- A warning ignored every day stops being a warningThe bell nobody hears
- Security friction moves behaviour elsewhereSqueeze it here, it comes out there
- MFA fatigue weaponises repetitionAsk forty times
- Verify suspicious requests through a separate channelRing back on a line they never gave you
- People need a safe way to report mistakes quicklyThe shortest road back