Threat Intel
Don’t Click Links in Emails From Your Bank: Lessons From Corporate Phishing Tests
Working in the Online Banking Division at JPMorgan Chase, building business and corporate banking solutions, I see firsthand how the human firewall actually behaves under pressure.
George Halfkenny · Founder, Identity Defense 247
Working in the Online Banking Division at JPMorgan Chase, building business and corporate banking solutions, I see firsthand how the human firewall actually behaves under pressure. Every quarter, our internal security teams runs controlled phishing simulations across the organization. You would think that software engineers, product managers, and financial analysts—people who live and breathe digital systems all day—would spot a fake security alert instantly. You would be wrong. When a simulated email arrives with a subject line claiming an urgent billing discrepancy, an expiring corporate card, or a mandatory password reset from "JPMC Security," smart people click the link. They didn't click because they were careless; they clicked because the psychological trigger of institutional urgency overrode their technical skepticism. Let's talk about why institutional phishing works so well, and why the golden rule of banking security is never, ever clicking a link in an incoming alert.
The Psychology of Institutional Urgency
Attackers don't need to be technically sophisticated if they understand human workflow friction. When you are rushing to close a deal, manage payroll, or review quarterly deliverables, your brain is operating on efficiency mode.
A fake email from your "bank" or corporate IT department exploits that exact cognitive load. It introduces artificial panic: Your account will be suspended in 24 hours. Unauthorized login detected from an unknown device.
When people see their financial security threatened, the panic response kicks in. They look for the path of least resistance to fix the problem—which is usually a big, friendly blue button in the email body that says "Verify Account Now."
As someone who helped design these secure banking environments, I can tell you definitively: No major financial institution will ever email you a direct link to log in and fix an account error. They don't do it. Ever.
How to Build a Zero-Trust Habit for Inbound Mail
If you want to protect yourself, your family, or your business from credential harvesting, you have to engineer friction back into your workflow.
Treat Every Inbound Link as Hostile: If an email claims to be from your bank, your payroll provider, or your software vendor, assume it is an impersonation attempt until proven otherwise. It doesn't matter how polished the CSS styling is or how closely the logo matches.
Use the "Out-of-Band" Navigation Rule: Never navigate to a sensitive account via an email link. If an alert claims your account needs attention, close the email, open a fresh browser tab, manually type your bank's verified URL, and check your dashboard directly. If there is a legitimate security flag, it will be waiting for you inside the secure portal.
Understand the Internal Testing Mindset: Working inside JPMC taught me that security isn't about blaming the person who clicked; it's about building systems and habits that assume people will get distracted. That is why multi-factor authentication (MFA) and continuous credential monitoring are non-negotiable.
Technology changes rapidly, and phishing tactics are sharper than ever. But the defense remains stubbornly simple: separate your communication channel from your operational channel. Never let an email dictate where you log in.