Banks keep all sorts of metrics on customers, to approve or deny transactions. If someone types their password into bank .ru/phishy.php and never changes their password afterward, that's useful information. If they then try to buy $10,000 of bitcoin in coinbase, the bank algorithm should probably deny it or require more verification steps. I'm not saying this practice is good, but I get it. Also, banks share the same technology like chexsystems, who could use A/B testing for research. It's cheaper than focus groups. For example, if A/B tests show requiring customers to submit their username first, then on the next page it says "Hi Bill! Great day in San Francisco! Enter your password: " causes them to notice the url bar isnt chase.com, thats good tangible info that will save banks from losing customer money.

The same thing? I'm guessing there is a large number of non-tech employees that are bank customers. Sure, tech jobs might "train" their employees about phishing. I highly doubt the employees in the construction, automotive, service industry, retail, or any of the other than tech industries do any kind of anti-phishing training.

I can sympathize with a bank wanting to at least offer some sort of anti-phishing something to their customers. After all, it is the bank that has to deal with it when things go wrong. They have already started some customer education attempts with "we will never call you" type of things. This could just be the next step in that.

I've experienced first-hand, that banks have a sort of "paranoia level" value for each customer account.

I've reported my ATM card phished+stolen before. I took money out from an ATM in a bodega in a bad part of town (where the thief was apparently watching me input my PIN through the window); and then, when I stepped outside, the thief mugged me for the ATM card.

Luckily, they only got ~$1000 from the account (= my daily withdrawal limit at the time); and the bank reimbursed me for this.

Annoyingly, to get the bank to do that, I had to file a police report, and give them the investigation number.

I also (obviously) had to change my PIN.

Ever since then, though, my ATM card will no longer work at bodega ATMs in this bad part of town. (I worked in the area at the time, so this was easy to notice.) It also doesn't work for the PoS systems in the bodegas themselves! However, it still works fine in ATMs at real banks in the bad part of town; and at ATMs / PoS systems in other, less-sketchy parts of town.

My belief is that, once my bank had to pay out an theft-insurance claim for the account, they labelled me in their internal systems as "at high risk of being a victim of future theft" (a.k.a. an "easy mark") — and this then bumped up my account's "paranoia level" to protect against future theft. So now, my bank, when being asked to authorize any ATM transaction, will reject the transaction if the business making the request has ever been associated in their systems with fraud/theft claims (even as an intermediary); or if the business has a high rate of refunds; or doesn't have enough history; etc.

In other words, the bank seems to internally assign businesses a kind of "credit score" for authorizing transactions; and a transaction is only authorized if the business's "credit score" exceeds the customer account's "safety threshold." My safety threshold was increased, so low-credit-score businesses can no longer interact with me through the bank.

---

It should be clear what I'm getting at here: failing an internal-red-team phishing test, should bump up a given customer's accounts' fraud-risk safety threshold.

The idea is to preemptively 'harden' your customers against real phishing attacks by exposing them to controlled, simulated ones. By increasing their wariness and increasing their suspicion of fraudulent communications, you're trying to inoculate them against actual threats.

To provided educational materials to your customers, and hopefully drive down fraud related expenses.