Explain Phishing Attacks, Then Design Anti-Phishing Education for Crypto Exchange Users

You are a product manager at Coinbase, a cryptocurrency exchange. The question has two parts: first explain what phishing is, then lay out how the company should teach its customers to recognize and avoid it. ### Clarifying Questions - Is the main goal fewer customer losses, fewer account takeovers reaching support, or customer trust and retention? - Which customers are in scope: people signing up, existing verified customers, or both? - Should the education cover only the exchange account, or also self-custody wallets and the company's social and community channels, where impostors often appear? - Are there limits on budget or team size, or on how much friction we can add to sign-in and withdrawals? ### Part 1 — What phishing is Explain what phishing is and how a typical attack unfolds, using examples that apply to people who hold crypto on an exchange. ```hint Think like the attacker Lay the attack out as a sequence of steps from the attacker's side. What must the victim believe, and what must the victim hand over, for the attack to pay off? ``` #### What This Part Should Cover - A precise definition that separates phishing from other attacks, such as malware or password guessing - The stages of an attack and the channels it arrives through - What makes crypto customers attractive targets and their losses hard to recover ### Part 2 — Teaching customers to resist it Design how the company should educate its customers about phishing: whom to focus on, what they need to learn, where and when the education reaches them, and how you would know it reduces harm. ```hint Picture the moment of the mistake Think about what a customer is doing at the moment they are fooled. Would a lesson they saw weeks earlier come to mind then? ``` #### What This Part Should Cover - A segmentation of customers by risk and experience, with a justified focus - The specific moments when customers are attacked, such as sign-in, withdrawals, wallet connections and contact with support - Education formats and placement, weighed against friction for legitimate use - Metrics that capture behavior change and losses, not content views ### What a Strong Answer Covers - Security mechanics in Part 1 that are correct and that shape the plan in Part 2 - How education works alongside product safeguards - A prioritized plan with explicit trade-offs between safety and friction - Measurement of an outcome that is rare, delayed and under-reported - Risks such as warning fatigue and attackers imitating the company's own messages ### Follow-up Questions - Attackers start sending emails that copy the look of your education campaign. How do you respond? - A customer loses funds after approving a malicious wallet signature on a site the company does not run. What is the company's responsibility, and what would you change? - How would you show that the education program, rather than other changes, reduced phishing losses?