Chronicle the Fifth · From the Court Records

The Trial of a Phishing Email

Let the record show the accused arrived in the royal inbox at dawn, claiming urgency. Everything that has ever ruined a kingdom has claimed urgency. Bring it forth.

This day the court tries one email, subject line "FINAL NOTICE: Your Account Will Be Suspended!!", on charges of impersonation, extortion, and crimes against punctuation. A jury of twelve honest emails could not be found anywhere in the realm; the court has seated eleven receipts and a newsletter. The accused requested a swift verdict. Denied. Swiftness is how it wins.

The evidence is presented

Exhibit A: the false livery. The accused wears the colours of the royal bank. The herald tapped upon its noble display name, and the true address fell out, like a false beard at a funeral: a rabble of random letters lodging at a free mail house. Asked to explain the discrepancy, the accused stated that it was "travelling".

Exhibit B: the cursed link. The button reads "Verify Your Account". The scribes hovered above it, without clicking, for the scribes wish to live, and beheld the true destination: an address wearing the bank's name with extra words bolted on, in the manner of a stranger at the gate introducing himself as Sir Bankly of Bank-upon-Bank. The jury of receipts gasped. The newsletter tried to get everyone's email address.

Exhibit C: the manufactured panic. "Within 24 hours." "Immediately." "Final notice." The accused deals exclusively in deadlines, for a frightened subject stops reading exhibits. Panic is not a tone, subject. Panic is a technique. The court notes that the accused's own deadline expired mid-trial and nothing whatsoever happened, which the accused described as "a grace period".

Exhibit D: the demands. A password, or failing that, payment in gift cards. The court has ruled on this before and will rule on it again, unto the heat death of the inbox: no bank, no tax office, no legitimate power in this realm or any other settles its affairs in gift cards. The request is not evidence of a crime. The request is the crime, wearing a name badge.

The witnesses and the defence

The court calls the Squire of Shadow IT, who admits he clicked the link "to see what it was", entered his password "to check if it still worked", and then, when the page errored, entered his other password. Both passwords, the record shows, were the same password. The Squire is not on trial. The Squire is never on trial. The Squire is, however, why the court exists.

The accused is defended, as is customary, by the spam filter that failed to catch it, who argues that it had been "having a heavy Tuesday" and that the accused "seemed legitimate at the time", an argument the filter has now made at four hundred consecutive trials. The court further consults the Roll of the Clicked, the great ledger of every subject who has ever fallen for such a missive. It is the longest document in the kingdom. It is longer than the kingdom. Nobody who reads it may feel superior, for the reading room requires a login, and the login page has caught more visitors than the Roll itself.

Sire, the defence claims the accused was written by an artificial intelligence and should be excused as the crime of a machine. I have read the accused. It addresses the Squire as "Dear Valued Customer_FNAME". If this is the machine intelligence we are told will surpass us, I move we stop worrying.

The sentence

Guilty on all counts. The sentence is carried out at dawn: the accused is forwarded, in chains, to [email protected], where the National Cyber Security Centre keeps the gallows, and its texting cousin is marched to 7726. The remains are then deleted, unanswered, for a reply tells the brigand the address is alive, and this court does not correspond with the condemned.

The learned append one line for the Squires in the gallery: whosoever gave the accused a password should change it now, everywhere it was reused, and hang the second factor on the gate behind it. The Squire has complied. Twice. Both times, the record shows, to the same password.

The accused begged for mercy on grounds that it was "just doing its job". So is the executioner. Court adjourned.