Why are phishing attempts so obvious?

Question

I understand that regular e-mail scams are dumb on purpose, to filter out smart people and make the processing of the replies easier.

But phishing is based on tricking people into thinking their bank (for instance) is talking to them. Yet almost every phishing e-mail I've ever seen is always visibly fake and poorly made. Why don't they just copy the bank's existing email/website template?

The accepted answer here mentions that

In phishing, as in scams, sending the initial batch of emails is the easy part. The hard part is coaxing information out of the target (which can require a concerted exchange of emails).

But why? Isn't phishing specifically about obtaining credentials? Why would that require a manual exchange of emails?

Answer 1

This may just be a psychological fallacy in which you only notice the phishing attempts that don't trick you. There are certainly phishing attempts that are near exact copies of the site they are impersonating that trained security experts can (and do) fall for when not alert.

Malwarebytes posted this on their blog, which contains some side-by-side images of phishing login pages next to the site they're impersonating.

As you can see they're similar to the point of being indistinguishable unless you're looking at them side-by-side like this. You're right in that many phishing emails/sites are poorly done - this is generally because it is time intensive to make something a near match, and wouldn't result in as significant an increase in successful phishes as you may think. Overall, for many low-lever phishers the cost outweighs the reward.

Answer 2

Because enough people are stupid enough to believe them that making them look more "real" isn't worth the scammers' time and money.

Basic economics, the scammers are thinking at the margin, balancing the incremental increase in revenue against the cost of a higher-quality fake site.

Answer 3

With many of these phishing campaigns, its a numbers game. Send enough messages, some people will respond. It is simply not worth the investment in time for some and many people fail to read messages carefully before responding.

As for the emails being dumb on purpose - possibly, but I'm not so sure - many of these campaigns are run by individuals with a poor grasp of English - English is not their first language, or the text has been run through an online translator.

Why don't they just copy the bank's existing email/website template - There are some scammers that do invest more time and undoubtedly get better returns. Although phishing sites do get shut down quickly and need to be recreated on many different domains. Time and effort required is likely to be a significant factor for many phishers.

Phishing is about obtaining credentials, but the term is also used for spam emails that are sent to spread malware via attachments or links to drive by download sites. Those require no exchange of emails.

Answer 4

I think your understanding of phishing may be a bit limited. Yes, for the reason you mentioned above, your everyday, cast-a-wide-net phishing emails are dumb, for the exact reason you mentioned. Spear phishing and whaling are more specifically targeted, and generally much better crafted. It make sense to spend more time on these targets since the payout per individual target is much higher than your everyday run-of-the-mill scam.

Also, phishing is not limited to obtaining credentials specifically. It can more generalized to include obtaining any type of information, or get the user to perform a specific action, such as view a malicious document which could install malware.