Sometimes, the people you expect to be competent at what they do confound you big time. The latest example of this involves a purveyor of financial crack to the middle class, a credit card company.
Said credit card company, a very large one in the field, threw some e-mail my way the other day that left my jaw dropping from its cluelessness. This message purported to be a way to introduce me to a security feature this company was promoting—namely one-time use card numbers for online use. The e-mail itself was fairly inoffensive and to the point. It did a good job making its case for the use of these kinds of numbers and used the word “security” often. All is well and good.
Then comes the kicker. There was an embedded link in the e-mail to “activate” this “security” feature. Just click here Mr. User and all will be well. My jaw hit the floor.
How can the credit card company be so dumb? Have these bozos never heard about phishing and spoofing? All I could think of was that the instant some bad guy got a hold of this e-mail, he would think it was a gift from the heavens. He can spam this very real-looking message with all the right information in it to the world with a redirected link in that button, and Mr. User—thinking he is being so very smart about security—will fall over and spew any credit card information that the phisher wants.
Even better, should Mr. User be a cautious sort he can call this credit card company to see if it had indeed been sending this e-mail to cardholders. Very astute. The card company will say that it has indeed been sending this e-mail about security to people. So Mr. User clicks the button containing the spoofed link, secure in his belief that this is a real message from his real credit card company. When he gets nailed by the phisher, he does so all the while telling himself that he was a smart user who wouldnt get fooled by some nasty fellow. In short, Mr. User has become the perfect mark.
Its easy to blame stupid users for behavior that leads to bad stuff happening. But when someone who is selling you “security” totally misses the side effects of their own actions, its impossible to smugly blame it on a user. In my not so humble opinion, the credit card company should tar and feather whoever approved sending this message, preferably in public.
There are so many ways the company could have done this without setting up its users to be a target. The e-mail could have told users to directly enter a URL into their browser. It could have said just to go to its main Web site page and directed them from there. This embedded link was not necessary. It was just plain stupid, and shows that despite their lofty words, these guys dont have a clue about how to do things securely.
Well, its things like this that make getting up on my soapbox and ranting worthwhile, if only it stops the corporate arrogance of those who should know better.
