On this webpage, the BBC says:
I’ve received a ‘Changes to your BBC account’ email claiming to be from the BBC – is this a genuine email?
At the end of September 2016, we upgraded our ‘BBC iD’ sign-in system to ‘BBC Account’, and as a result we had to sign everyone out of their ‘BBC iD’ account.
If an email address was previously registered against a ‘BBC iD’ account, we’ve been sending emails to these email addresses (from ‘firstname.lastname@example.org’) advising users that we’ve signed them out of their account and asking them to sign back in.
These are genuine emails from the BBC and not phishing emails or spam (below is a screenshot of the email content).
… and that's it.
I discovered this on a Facebook comment thread, where the above webpage was given as "proof" that an unexpected email was genuine and not a phish.
The email contains a link to "sign in" — this link will require users to input their credentials, by definition (due to the reason for sending the email in the first place).
Isn't all of this incredibly irresponsible? Isn't the BBC grossly mistraining its audience? The From field of an email has never been anywhere close to proof of the sender's identity, and providing a screenshot of the genuine content just makes it easier for fraudsters to reproduce it and con people.
Or am I missing something?