Are there banks/companies proactively trying to trick customers? Call, then throw up some red flags, then educate? Especially for older customers a "near-miss" might be helpful to lower the risk of them getting scammed.
And of course, their "scam-like" emails end up in the inbox, while real scammers emails would end up in the Spam folder.
Judging by their frequent and long lectures about how I'd be liable for any fraud, it sounds like they've absolved themselves of responsibility too well to need to improve fraud protection
They send email from an unfamiliar domain, not the one customers know from their website, nor a subdomain thereof
They call customers and ask for security information
They ask for one-time codes on some calls from customers, but they also separately say it's something that only fraudsters do
All of the above risk causing customers to lower their guard to fraud
They fail to recognise repeat payees to validate payment details when taking international transfer instructions by phone, which risks fraud (if an invoice seeming to be from a regular supplier is actually from a fraudster) or other loss (if the payment details are misheard)
They also fail to recognise repeat payees when using transaction history to flag unusual activity, which only increases false positives, so it isn't as bad, but it's still annoying
Prime example, Santander
From: Santander <santander@email2.yoursantander.co.uk>
Subject: Know more about Facebook Scams
Congratulations Santander, you've now trained your customers to trust emails from domains like "email2.your<business>.co.uk"
Perhaps you meant this the other way around?
Either way, I have received quite a steady stream of rather obvious phishing attempts directly to my inbox on Outlook.com. Once our twice a month I have a missed Amazon package, or some horrible debt, or an being investigated for tax fraud or other such.
But if a scammer sends me a fake email, it'll probably get caught in the spam filter of my email provider (hopefully).
I still forward all these "training" emails to abuse at corporate because if I'm doing extra work, they're doing extra work. Recently, they've automated this though because when I email abuse, I immediately get a reply saying congratulations, this was a test message. If this were a real bla bla... Anyway, I think it is safer to forward to abuse just in case.
Sounds like a cool service.
Except they don't do it as a teaching experience, but as part of their normal operations, and if you refuse to do the extremely sketchy, red-flag, never-do-this thing, you will not be able to get your task done.
I've been required to provide part or all my online banking PIN on the phone and my credit card PIN on a random sketchy website (as part of 3DSecure). Different banks. Both legit and repeated.