Today, I got a phishing email impersonating a large bank. To my surprise, the link in the email pointed at a rather sophisticated phishing website which could potentially result in many victims. The bank had already been notified and it will probably try to take down the website and raise awareness for the presence of this phish among its customers. This made me wonder, what one could do for people that had already fallen for this phish.
The first thing I thought about was to flood the phishing website with potentially valid data. (Not random data) It is pretty easy to automate and over night the number of invalid entries in the database compared to the number of valid entries will be very large.
Of course, threat actors will try and automate their validation process as much as possible as well. However, I could offer the bank access to my fake dataset to cross reference with invalid logins. Besides that, maybe the fact that lots of invalid login attempts have to be made to find the valid ones will be good enough to trigger fraud detection at the bank.
At first glance, it seems as if this method could be effective but I was not able to find any documentation regarding usage of such a method. This implies that it is likely that there are some valid reasons against.
This leads me to the following questions: What would be the drawbacks of using the described method to remediate existing phishing attacks in terms of ethics and effectiveness? Why would a company that is often impersonated in phishing attacks use it or why not?