A software developer recently received a text message from an unknown number. The sender claimed to be customer support from a major retail bank, instructing him to call a phone number that appeared nowhere on any public directory. To verify his identity, the agent asked him to read aloud confidential security numbers from the back of his credit card. The message was entirely authentic—a genuine alert from his actual bank. Yet its operational behavior was completely indistinguishable from an overseas telecom scam.
Legitimate Logins Across a Dozen Domains
Security professionals lecture the public every day with a simple mantra: never click suspicious links. Yet in day-to-day operations, enterprises have thoroughly pulverized this rule. Developer maurycyz recently published a detailed breakdown of what has become the standard corporate login flow: a user starts on a company’s main website, but instead of remaining on that secure root domain, they are immediately bounced to a login address hosted under a third-party SaaS provider.
From there, the browser hops through an authentication hub identified only by a long hexadecimal UUID string, before getting redirected to yet another unrelated vendor to satisfy a two-factor authentication challenge. After that gauntlet, the user might be rerouted to a telemetry-gathering “experience center” domain, before finally tumbling back to the original company’s root address.
By the time the authentication dance concludes, not a single field where the user typed their username, password, or SMS verification code was hosted on the enterprise’s own domain. When legitimate workflows look like an obstacle course of suspicious redirects, attackers do not need zero-day vulnerabilities. They merely need to spend a few dollars registering a typo-squatted domain, paste in a few lines of HTML with a password box and the target logo, and harvest credentials at will. In an environment where expired session tokens trigger random login popups throughout the workday, nobody can tell the difference between legitimate infrastructure and a scam.
Figure: An official SMS from a delivery courier. Source: Troy Hunt / troyhunt.com
How Everyday Enterprise Workflows Destroyed Domain Trust
The internet’s Domain Name System was originally designed with pristine clarity. From the broad top-level domain down to the operating entity and specific hostnames, this hierarchical architecture was intended to serve as the digital world’s premier authenticity guarantee. Yet underneath decades of corporate outsourcing and cloud sprawl, the single most identifiable anchor—the second-level domain—now sits buried inside messy redirect chains.
Modern users are expected to complete dozens of authorization prompts and authentication clicks every day across their mobile devices. Expecting individuals to manually verify cryptographic certificates and multi-tenant domain structures in a state of chronic cognitive fatigue is an evasion of engineering responsibility. When financial institutions routinely blast marketing SMS messages featuring opaque URL shorteners, and when official support emails route customer satisfaction surveys through obscure third-party marketing domains, businesses are actively training their customers to ignore URL structures altogether.
Figure: A follow-up SMS from the same sender the next day, equally impossible to verify. Source: Troy Hunt / troyhunt.com
Advising users to avoid dangerous links has devolved into an empty platitude because enterprise communications routinely look far more suspicious than professional phishing lures. Security practitioners report having to flag legitimate business emails from Microsoft as junk because those messages—heavily instrumented with tracking redirectors and external links—match every heuristic marker of modern spear phishing. On developer forums, practitioners frequently admit to reporting their own banks’ official communications as phishing simply to force security teams to confront the absurdity of their operational posture.
Figure: In a follow-up email three days later, the line between official corporate outreach and scam tradecraft completely disappears. Source: Troy Hunt / troyhunt.com
Four Engineering Baselines to Rebuild System Trust
Exhausted by hollow awareness training, the engineering community has begun codifying hard architectural requirements modeled after RFC protocol specifications to restore baseline trust.
First and foremost is domain consolidation. Large organizations MUST anchor all core business operations to a single, well-recognized root domain. Every internal service involving authentication or user data MUST live on subdomains of that root. Ad-hoc branding domains combined with third-party hosting platforms—the hallmarks of scam-like normalization—MUST be banished from enterprise architecture.
Equally strict baselines apply to outbound messaging channels. When an SMS or email requires a user to submit feedback or update account details on a third-party service, the engineering team MUST implement an in-house redirect proxy on their own servers. The link clicked by the recipient MUST reside on the company’s verified domain before silently proxying the request to the upstream vendor.
This principle extends directly to telephony and voice communications. Organizations MUST NOT broadcast SMS alerts or emails urging customers to dial unverified, ephemeral phone numbers. Any required contact information MUST be presented on a secure web page linked directly from the primary verified domain, rather than dangling inside unauthenticated SMS text.
How India Reigned in the Chaos in Six Months
Faced with endemic fraud, attempts to change human behavior through perpetual user education are doomed to fail. Durable solutions require architectural isolation at the infrastructure layer. India provided a compelling blueprint over the past year by enforcing mandatory domain and telecom ringfencing across its financial sector.
Under regulatory directives, all Indian commercial banks are mandated to operate exclusively on dedicated top-level banking domain extensions, with non-banking financial institutions assigned dedicated financial TLDs. Whether hosting customer-facing portals, emailing monthly statements, or handling internal authentication redirects, every service must terminate under this regulated namespace.
More decisively, Indian telecom regulators closed off the public voice network to unverified outbound calls. Outbound banking and transactional voice calls were forcibly restricted to the dedicated “1600” number prefix. Directly administered by the Department of Telecommunications, this series is reserved exclusively for banks, financial services, insurance providers, and select government agencies. Its sole purpose is to create a physical, interface-level distinction between regulated financial communications and ordinary commercial telemarketing. Unlicensed entities cannot acquire numbers in this block. With only a six-month transition window, the nationwide banking network completed the migration nearly overnight.
Offloading System Failures onto Users Is a Security Abdication
Mandatory isolation at the infrastructure layer accomplishes more than millions of dollars poured into awareness campaigns ever could. Users no longer need to parse DNS hierarchies, untangle complex redirect parameters, or rely on seasoned digital literacy. If a portal does not end in the designated banking domain, or if an incoming call does not carry the verified regulatory prefix, it can be treated as fraudulent by default. Global users face an identical dilemma every day: legitimate bank communications and fraud syndicates share the same delivery conduits, and telling them apart often hinges on whether a phone number happens to appear in an underground black-hat database.
Security engineering expert Kelly Shortridge has frequently observed that the security industry harbors an unrealistic obsession with “security culture.” This mindset shifts the burden onto human beings, demanding endless vigilance over minute technical boundaries in systems designed to induce error, expecting users to make flawless judgements hundreds of times a day.
Expecting everyday consumers to distinguish legitimate identity providers across a dozen cascading redirects is the equivalent of expecting hotel guests to cryptographically audit the RFID firmware of their room keys. India’s regulatory overhaul proved an undeniable engineering reality: dumping flawed system architecture onto the user is the industry’s greatest abdication of responsibility. If enterprises cannot even consolidate their authentication entry points, anti-phishing education will remain nothing more than institutional self-delusion.
References:
- maurycyz.com original post
- Lobsters discussion
- Troy Hunt related article
- HN discussion
