I was thinking, "Gee, if a scanner put a random color bar at the top of the phishing emails, how often would the color look close enough that the user couldn't distinguish between it and their own color, at least without comparing the colors side-by-side?", but I'm not convinced users would even remember their colors after the second or third one.
(And if course, this is very flawed for the color-blind and utterly useless for anyone using screen-readers.)
As far as colours on emails goes, if everyone starts doing it, nobody will remember which colour goes with which company. It needs to be something more distinctive than just a colour band.
They replaced it last year with mandatory SMS 2FA. I immediately sent them a message about how insecure it is but never received a response. What a terrible regression.
Also, let’s suppose a database of users and their associated color is compromised but that the intrusion is not immediately detected. This allows scammers to craft emails with the right color of banner leading to “but the email has the right color at the top so it can’t be a phishing scam” logic.
It may just shift the problem.
I wanna say it was something about colouring the login box, but I can't make that make sense.
