American View: Résumés can’t tell you what a candidate brings to your organisation

This a basic phish. It doesn’t use any CostCo branding content like logos or standard fonts. Enough work went in to making it look official; it’s not making any effort to mimic real Costco communications.  Still, while it’s obviously a scam to a security professional, it could fool a normal user. The FOMO factor and the greed trigger (i.e., gaining around $100) should motivate a lot of victims to click that glaring blood-red button and at least checking out the “survey” page. Most importantly to me, it’s “tells” are easy to highlight. That’s why I felt compelled to GTA-ifiy it [1] and share it. Here’s what I threw together: 

Does my GTA look professional? Eh … no. Not really. Sure, it would be cooler with branding, cool graphics, and tighter language … But I reckon it’s good enough for its intended purpose. I whipped this up in ten minutes using PowerPoint. In security awareness, warning speed often trumps aesthetic perfection. Put another way, getting a warning in front of potential targets quickly is better than delaying publication for quality improvements! Human risk is not a corporate communications function; we don’t need to impress anyone with slick design, just like the corpcomm folks don’t need to combat scams. Different production standards for different missions.  

More importantly, the amateur feel of my GTA enhances its appeal. It’s unpretentious. It clearly wasn’t focus grouped and polished for maximum appeal. It was obviously something thrown together to serve a purpose, not to burnish the company’s image. That function-over-form approach resonates with users below the director level; everything produced for the brass must be polished, ergo this GTA was crafted for the people! Therefore, our targeted audience is more likely to read it. That credibility leads to lowered defensiveness which in turn leads to greater retention.  

Back when I was running a security awareness program, I’d slap together GTAs like this between meetings and post them to our internal social media channel. Users would them chime in about variations of the scam they’d encountered and offer screenshots of their own. Not for clout, but  to help protect the community. Some users ignored us, but that was their prerogative; our GTAs were optional, “pull” content. Despite not getting 100% coverage, our approach worked well.  

Over time, our team’s constant social media presence allowed us to build on our prior work through additions and callbacks. For example, if I’d posted my CostCo scam GTA on Monday, I’d likely follow up Tuesday with this “variations on a theme” comparison graphic: 

The second GTA reinforces the first one. I chose two other examples from a pool of eight to show how the same attack can be assembled with different templates. More importantly, these side-by-side comparisons also subtly train a user how to focus on the three “telling” indicators of this phish (i.e., the context violation, the appeal to emotion, and the call to action). That builds skill in such a way that’s transferable to all other phish.  

Then there was the entertainment factor. I chose the example offering the free “meat box” lure because that was guarantied to titillate some of our more users, thereby making the lesson more memorable … and significantly increasing the likelihood that those amused users would share it with their equally amusable pals. Those sharers lent their professional credibility to our effort, getting more eyes on the content than we’d managed on our own, and conveying their endorsement of our efforts. 

In keeping with the additions tactic, now that we’d established the different flavours of Costco FOMO scams, I’d probably post a third GTA that demonstrated how scammers apply the same formula to other popular brands, like this: