When Real Companies Teach Customers to Be Phished
Legitimate messages that look like scams train people to ignore warnings. A five-point scorecard for verification routes, with documented examples.
Teaching a person that a message is probably fake works only if real messages look different. Many do not. A customer is told never to trust unexpected contact, and then a company contacts them unexpectedly, asks them to follow a link, quotes their account details and calls it service. The customer is left with two rules that cannot both be followed.
This is not an argument for blaming companies for fraud. It is an argument that a company’s habits are part of what its customers learn, and that the lesson can be designed.
A scorecard for any company’s outreach
We propose five properties of a message route that make verification possible. They come from our reading of the sources below, not from a published standard, and any team can score its own outreach against them.
| Property | What it means | A failing example |
|---|---|---|
| Customer-initiated where possible | The sensitive step starts with something the customer did | An unrequested message that asks you to act through a link it supplies |
| Announced in advance | The customer was told earlier how and when the company will contact them | First contact arrives with no prior statement of how contact works |
| Never-list | The company states what it will never ask for | Messages ask for codes in some contexts and warn against sharing codes in others |
| Consistent across teams | Support, billing, marketing and fraud all follow the same rules | The fraud team says “never click links”; the marketing team sends links |
| Checkable by the customer | There is a published route the customer already holds | The only way to check is a number in the message itself |
Documented cases: outreach that looks like what it warns about
We looked for real examples and could use only those with a source. The common thread is that the legitimate behavior and the fraud share a shape.
Notices that say both “we will contact you” and “beware contact”
Japan Airlines, reporting an Amadeus breach on October 28, 2026, said it would contact affected customers individually while urging vigilance against “phishing emails, fraudulent phone calls” and websites impersonating the group, as reported by The Record. ENGIE sent letters to French customers that, per BleepingComputer, listed the exposed fields, including a customer ID and a contract number. Neither report we read says how a customer can tell the company’s follow-up from an impostor’s. That does not show a failing at either company; we only read press coverage, not the notices. It shows the gap that the FTC’s business guide asks companies to close by explaining “how you will contact people in the future,” as covered in our piece on why “stay vigilant” is not a breach response.
Official-sounding names used by commercial sellers
The FTC alleged in its MediaAlpha case that the company used domain names such as ObamacarePlans.com that suggested a government affiliation, and that a government impersonation scheme targeting travelers used paid search ads to appear as an official passport service (see the October 22 complaint announcement). These are allegations. If true, they are examples of companies teaching customers that an official-sounding address is evidence, which is the habit that makes impersonation cheaper for everyone else.
Legitimate tools used as the weapon
Check Point’s Q3 2026 post describes a fake “Update Required” prompt, on lookalike Docusign pages, that downloaded a legitimate remote-management tool and used it to gain unauthorized access. A real vendor’s update prompt is a normal experience. A fake one uses the same words and installs a program that is not malicious in itself. A customer taught to accept installer prompts from vendors has no cue to separate them. See the Check Point post.
The opposite example: an agency that states its never-list
The FTC’s October 22 alert on phone-deactivation calls does the reverse of what we have been describing. It says a real FTC employee will never ask you to send money, threaten to disconnect your phone, tell you to keep conversations secret, or text you a photo of an employee ID to “verify” identity. Those are rules a customer can hold a caller to. The never-list is among the cheapest verification tools there are, and few companies publish one. See the alert.
Why the problem is hard to see from inside
Each team that sends messages makes a locally reasonable decision. A marketing group includes a link because links produce clicks. A billing team sends a payment reminder with a pay-now button because it reduces calls. A support team phones a customer to resolve a ticket because it is faster than email. No one is accountable for the sum, which is a customer who has seen five different styles of contact from the same name.
The same fragmentation shows up inside organizations, where an employee cannot tell a real internal request from a fake one because internal requests are also inconsistent. Our article on new starters and unwritten rules describes that gap; the customer version is the same gap with a shorter memory.
What fixing it looks like
- Write the never-list. Agree between fraud, support and legal what the company will never do. If you cannot agree, you have found the inconsistency. Publish the list where customers already look: the account page, the first email, the footer.
- Prefer a route over a link. “Open the app and look under Messages” works for a customer who cannot be sure about a link. It takes more thought from the sender and is much harder to copy.
- State the channel in advance. At signup or at the start of a case, say how the company will contact the customer and from what number or address. A message that arrives by another channel is then out of pattern. Our article on when a conversation moves channels explains why that matters.
- Test with someone outside the team. Show the message to a person who does not work there and ask what they would check. Do not ask whether it looks real; ask what they would do to find out.
- Make the check accessible. A route a customer cannot use turns into an exception. See a verification process people cannot use becomes an exception factory.
What the evidence does and does not say
We found no controlled study of whether inconsistent legitimate outreach raises customers’ susceptibility. The nearest evidence is indirect: a 2024 student study by Crgol and Vrhovec reported no significant association between recognizing phishing or genuine emails and responding to a phishing attack, which at least suggests that “looks real” and “is real” are not reliably separated by recognition. That is one small study. The cases above are documented events, not a measurement of effect.
The argument is therefore structural. It follows from what we know about learning from experience: people generalize from the messages they see most. If real messages routinely ask for things that fraudulent ones also ask for, that is what customers learn.
Scoring an example
Take an invented subscription service. It sends a billing reminder with a “pay now” button, calls customers when a card expires, and publishes a fraud page that says “we will never email you a link.” Against the scorecard: customer-initiated, fails (the reminder is unrequested). Announced in advance, fails (the call is not mentioned at signup). Never-list, contradicts itself (links appear in emails the fraud page forbids). Consistent across teams, fails. Checkable by the customer, partly passes (the account page shows balances).
One pass out of five is not a scandal. It is an ordinary company. The scorecard makes the choice visible: change the reminder so it points to the account page without a link, mention the call at signup, and edit the fraud page to say what is actually true. That is a week of work, and it turns three accidents into a rule.
Who owns the sum of the messages
The structural fix is organizational. Someone has to own the customer’s total experience of being contacted, with authority over marketing, billing, support and fraud teams. In many companies that person does not exist, and the closest candidate is the fraud or security lead, who rarely has authority over what marketing sends. Naming an owner, even part time, is the step that turns the scorecard from an audit into a practice.
Sources
- Japan Airlines warns of breach (The Record, October 28, 2026).
- Energy giant ENGIE discloses data breach affecting customers (BleepingComputer, October 27, 2026).
- Data Breach Response: A Guide for Business (FTC): advice to explain future contact.
- FTC Sues Perpetrators of Government Impersonation Scheme (FTC, October 22, 2026), and FTC MediaAlpha settlement summary (August 2025): allegations about official-sounding names.
- Inside the Q3 2026 Brand Phishing Report (Check Point, October 16, 2026): fake Docusign update.
- The FTC is not calling to deactivate your phone number (FTC, October 22, 2026): the never-list.
- Crgol and Vrhovec, JUCS 30(9), 2024: recognition and response.
Found a factual error or a source that has changed?
Send a correction →
