Most people still imagine cyber attacks as something obviously suspicious.

Broken layouts, strange email addresses, aggressive warnings, bad spelling.

But the most effective attacks rarely look dangerous anymore.

They look normal.

A Microsoft login screen.
A delivery update.
A Teams notification.
A password reset request.

Clean.
Familiar.
Low friction.

In other words: trustworthy.

That’s partly because modern interfaces are designed to reduce hesitation. We optimise for speed, clarity, and seamless interaction. Good UX removes unnecessary thinking from the process.

Usually, that’s a good thing.

The problem is that attackers learned the same lessons.

Modern phishing succeeds for the same reason modern products succeed: people recognise familiar interaction patterns and respond automatically. Most users are not carefully evaluating every screen they see. They are moving quickly through environments they’ve been trained to trust.

The interface does most of the persuasion before the user consciously thinks about it.

Over time, repeated digital experiences condition behaviour.

Click here.
Approve this.
Sign in again.
Open the document.
Scan the QR code.

Eventually, interactions stop feeling like decisions and start feeling like routines.

That’s where risk changes shape.

The danger is no longer just suspicious-looking interfaces. It’s interfaces that perfectly imitate the safe, polished experiences users encounter every day.

The cleanest scams don’t create friction.
They remove it.

And that creates an uncomfortable tension for modern design.

Because many of the qualities we associate with good UX — familiarity, speed, clarity, seamlessness — also make interactions easier to trust without scrutiny.

That doesn’t mean good UX is bad.

But it does mean we may need to rethink what “good” means in high-risk environments.

Not every interaction should feel effortless.
Not every moment should be optimised for speed.

Sometimes hesitation is protective.

Sometimes friction is the feature.

And sometimes the most dangerous interface is the one that feels completely safe.