Pro tip: A 12 year old taught me more about phishing than 5 years on the job did

My neighbor's kid came over last Saturday to ask for help with a school project. While I was showing him how to spot fake emails, he pointed out that the 'urgent' tone in a sample phishing email I used looked exactly like the emails his mom gets from her bank. He said 'why would a real bank threaten you in the first sentence?' and honestly that hit different. I've been in IT security for 5 years and never thought about it that simply. Now I use that as my first example in every training I run. Has anyone else had a kid or someone outside tech make you rethink how you explain this stuff?

3 comments

3 Comments

burns.brooke20d ago

That thing the kid said about urgency really stuck with me too. I work in IT support and I've seen grown adults fall for emails that scream "URGENT ACTION REQUIRED" in the subject line. But when I explain it like the kid's logic - why would a real bank start with a threat instead of something normal like "we noticed something odd" - it clicks way better with people. Kids just have this way of cutting through all the noise we've been trained to ignore.

joseph_lewis9220d ago

why would a real bank threaten you in the first sentence?" That's actually a really good point but I gotta push back a little on the idea that this is some kind of revolutionary new insight. Legit banks DO use urgent language sometimes, like for fraud alerts or suspicious login attempts. It's just that scammers push it way too far and make it sound like they're about to call the cops if you don't click in ten minutes. The real trick is teaching people to check the actual SENDER and the link URL instead of just looking at the tone. That kid was onto something though, he just didn't have the full picture yet.

skylershah20d ago

Hold on, are you telling me that kid actually figured this out better than most security training programs do? That's kind of wild when you think about it, since we spend millions teaching adults and a kid just sees it plain as day. Maybe the real problem is that we've all been trained to ignore our own instincts.