And of course, their "scam-like" emails end up in the inbox, while real scammers emails would end up in the Spam folder.
Judging by their frequent and long lectures about how I'd be liable for any fraud, it sounds like they've absolved themselves of responsibility too well to need to improve fraud protection
They send email from an unfamiliar domain, not the one customers know from their website, nor a subdomain thereof
They call customers and ask for security information
They ask for one-time codes on some calls from customers, but they also separately say it's something that only fraudsters do
All of the above risk causing customers to lower their guard to fraud
They fail to recognise repeat payees to validate payment details when taking international transfer instructions by phone, which risks fraud (if an invoice seeming to be from a regular supplier is actually from a fraudster) or other loss (if the payment details are misheard)
They also fail to recognise repeat payees when using transaction history to flag unusual activity, which only increases false positives, so it isn't as bad, but it's still annoying
Prime example, Santander
From: Santander <santander@email2.yoursantander.co.uk>
Subject: Know more about Facebook Scams
Congratulations Santander, you've now trained your customers to trust emails from domains like "email2.your<business>.co.uk"
Perhaps you meant this the other way around?
Either way, I have received quite a steady stream of rather obvious phishing attempts directly to my inbox on Outlook.com. Once our twice a month I have a missed Amazon package, or some horrible debt, or an being investigated for tax fraud or other such.
But if a scammer sends me a fake email, it'll probably get caught in the spam filter of my email provider (hopefully).