Deceptive Subject Lines

Three recent laws (Washington, California and Maryland) are going to see Email Marketers rethinking their subject lines. While they vary somewhat in application, all three laws will inspire class action lawsuits for deceptive subject lines.  In Washington State, the penalty is $500 per email to a Washington State resident. Similarly, $500 per email for Maryland residents and $1,000 per email for California residents.  

There are some nuances (it's a little harder file in Maryland, California adds a twist to make it more difficult to get the case thrown out - but also caps the penalties at $1m per suit) but it all boils down to: does the subject line contain a provable falsehood? Doesn't matter if there's a caveat or legal disclaimer in the body of the email, does the subject line by itself contain a falsehood?

The examples fall into seven main categories:

1. Your subject line implies eligibility or pre-qualification

You claim “You qualify for…” or “You’re eligible for…” or “Reserved for you” but you haven't actually determined their eligibility or everyone qualifies. 

2. Your subject line says it's free but it's not

Your subject line suggests there's no cost, but there is a cost or other strings attached. It's not truly free. ("Free with purchase" is a big one.)

3. Your subject line promises savings or discount that might not be available

You tell readers they can “Save 25%” but the email says most won't qualify or you say “biggest savings of the year” when there's evidence of larger sales in the past year. It's ok to be vague, but if you make a claim, the claim must be accurate and it must be available to all.

4. Your subject line implies a deadline or urgency 

Your subject line says “Ends tomorrow” or “Last chance” or “Final hours” but it's not the last chance - the deal is honored after the indicated deadline or it was quietly extended or the aforementioned deadline mentioned doesn't apply to all recipients or website visitors. 

This is easy to prove by simply witnessing the deal still exists after the deadline.

5. Your subject line implies scarcity

Your subject line says “Only a few left” or “Limited quantities” or “Selling out fast” but the ofer is digital (unlimited) or you don't actually know how much inventory remains (or you know there's lots of inventory left).

For physical goods, it may be more of a challenge to prove without access to inventory or without monitoring the website over a sustained period of time to show continued availability.

6. Your subject line lies or makes a claim that isn't proven or misleads the reader

Your subject line says you're the "best" or "most popular" (compared to your peers) or suggests a ranking that doesn't actually exist. 

Your subject line suggests the email was supposed to be an internal email that was accidentally sent to subscribers.

Your subject line implies an error, correction, apology or retraction when you didn't actually make a previous public error.

7. Your subject line implies personalization or makes the reader think it's transactional when it's not

Note: This is more specific to California or nationwide via CAN-SPAM, but it's good to keep in mind. 

Your subject line suggests that the email is a "Re:" (reply) or "Fw:"/"Fwd:" (forward) when it's just a marketing email.

Your subject line makes the reader think it's a receipt or transactional message but it's just a promotional message.

Your subject line makes the reader think it's in service to their account or membership but is actually just a promotional message.

To sum... don't be a deceptive marketer. People who feel misled vote with the "unsubscribe" or "this is spam" button. Build a long-term relationship with your readers, don't try to get one over on them. It's not clever, it's frustrating and we see you. 

AI helped me with the research on this article and AI created the image inspired by Parks & Recreation.

120: Block Party Prison Fundraiser Timid Efficient Punishment

 Getting started: https://www.dylandrakes.com/writing-prompts and https://www.name-generator.org.uk/ 

• Genre: Crime/Prison
• Location: Block Party 
• Conflict: Having to Punish Someone
• Occupation: Fundraiser
• Positive Trait: Efficient
• Negative Trait: Timid
• First1 (Pro): Nadia
• First2 (Ant): Max

Two minutes on the clock... and go.

The block party had been a success. Well, it was sort of almost still a success. Only Max had apparently convinced half of the businesses to contribute to a non-existent fundraiser. And it had been going so well. It was well-attended, lots of families, lots of kids, lots of people lined up at the booths. The air smelled of popcorn and cotton candy, but also so many food trucks. And maybe even a little bit of exhaust from all their rumbling generators, but that was food trucks for you.

Nadia seethed. This was going to make her look bad. To hear the shopkeepers tell it, the story was simple and Max was so believable. And he was her co-chair for the event, so if a fundraiser was part of the festivities, why not chip in? 

She wanted to march right up to him and... well, she didn't know. She fantasized all kinds of violence, but, she wouldn't. She couldn't. But what could she do? She needed to confront him. He didn't know it yet, but he'd been found out and this was going to land him back in prison.

Grrr! She stamped her feet, now angry at herself for her inability to just confront him. To stick her finger right in his face and tell him what a bad thing he'd done. But instead, she felt weak and wanted to run to her car and hide and hope that the shopkeepers took the justice into their own hands.

And now, an AI:

The sun beat down on the pavement of Block C, where the "Block Party" was less about burgers and more about survival. Nadia, the yard’s most efficient fundraiser, clutched her ledger. She didn’t deal in contraband; she managed the protection pool, ensuring every inmate’s "subscription" was paid to the Shot Caller.

Nadia was valued for her math, but cursed by her timid nature. Her hands shook as she approached Max, a brute who had spent his commissary budget on tattoos instead of his weekly dues.

"Max," she whispered, her voice cracking. "You’re short. The bosses... they noticed."

Max laughed, leaning against the chain-link fence. "What are you going to do, Nadia? File a complaint? You’re a bean-counter, not a hitter."

The yard went silent. Nadia felt the cold gaze of the guards and the even colder stare of the syndicate leaders by the bleachers. She had been given a direct order: No exceptions. To maintain the system she had so carefully organized, she had to punish the deficit.

She didn't use a blade. She simply signaled the kitchen crew. By dinner, Max’s "protected" status was officially revoked. As the heavy hitters moved in to reclaim his bunk and his dignity, Nadia looked away, her heart hammering against her ribs. She had balanced the books with ruthless precision, but the cost was a weight her quiet soul wasn't built to carry.

And the AI's thoughts...

For next time, it suggested I:

• More Show, Less Tell (I'll probably continue to get this for awhile)
• Sharpen Verbs
• Deeper POV and Tigher Conflict for Timidity
• Sensory Contrast (perhaps the sweet cotton candy smell vs the sour feeling of betrayal).

I didn't ask for feedback last time, but I did notice how last time the AI had more sensory (especially smell) than mine, so that was one of the things I tried to improve upon this time.

I also overused "lots" and there was some structure I wish was better. Part of that might just be the nature of the short time-frame and the inability to go back and add or change anything.

Social Hacking

 I was reading this book that took place well in the future, but the ?gonist (don't know yet if he's good or bad) called up a new employee, said he was from HR and told them that they hadn't finished their compliance training. They weren't going to be able to issue paychecks until the training was completed.  Most likely it was a small thing - at the very end, there's a "submit" button that lot of people miss.

So while he on the phone with the employee, directed him to a website, had him sign in, click the "submit" button and then they were all good.

Except the website was fake and now our main character had this new employee's username and password.

Made me realize...

If you think someone might be performing social engineering against you, if you're directed to a site in a scenario like this, always enter your password wrong the first time. If the site accepts it, you've just prevented yourself from being hacked.

Conversely, if you build websites like this to hack people, always make it reject the first password attempt and make them try again. That will catch people who follow my earlier advice (and because people type their passwords wrong accidentally all the time), and for people who did type it right, now you have the correct password submitted twice and you can be much more assured that you have a good exploit.

task frustration

 I consistently have more tasks than I can handle and I had yet to find a solution that really works. I track everything in Remember the Milk, a pricey web app that seems like it's been in maintenance mode for the past few years, but after investigating newer more modern platforms, it still seems like I need the complexity and flexibility that RTM offers. (This seems to be similar to how SFMC is a better fit for me than the more modern current ESPs.)

Usually I'll have over 100 taska and I'll get the most important stuff done, but there's a lot that will remain online. And like a lint roller, each day rolls on, collecting more stuff that needs doing. 

I've tried taking tasks offline to a lst of things I want to get done, I've tried nearly-religiously tracking the number of things I get done so that I can make that the max that can be on the list, I've tried planning out lists for upcoming days (which meant creating lots of duplicates). None of these have worked or been manageable long-term.

So, I don't know if this latest round is going to work or not: I'm trying to pare down what's allowed on future days. No future day can have 10 items on it before we roll into it. I'm still carrying over a list and a lot of items have recurrence, but when I cross them off and they reappear on a future day, I'm looking at the future day to decide if that really belongs on that day, or if it can be postponed.  

So now I'm doing a lot of postponing. Slowly the ball of rollover tasks is getting smaller and tasks of a lower priority are getting pushed further and further out. Like all my past attempts, I feel optimistic for this. But... like every time before, the hopefulness is slightly less. 

For instance, an "introspective, family or identity" blog post (like what I'm writing right now) is something that's supposed to happen approximately after two weeks. But the last time I crossed it off on my list looks to be early May 2024. When the big pile of rollover is too big, it's easy to ignore everything that's not urgent and let it all roll over and over and over.  Hopefully by protecting the future a little better I'll actually do the next one closer to mid-April 2026 vs January 2028. 

Installed Package Rotation (Salesforce Marketing Cloud)

Sept. 30 is a new date you need to aware of if you work with SFMC (ExactTarget). 

Installed Packages are the combination of a (1) Client ID, (2) Client Secret, (3) a set of Permissions and (4) Business Unit access that together permit authorized systems (and dictate the scope of access) to send data *IN* to SFMC. (This is also sometimes used for CloudPages or SSJS activites.)

Previously, once you established an Installed Package, it just worked behind the scenes, permitting access to systems that had the credentials until you disabled the package or changed the scope. To make SFMC more secure, there are a few recent things of note:

1. 1. Installed Packages that were not accessed in 180 days have been invalidated. (They won't work until you rotate the credentials.)
2. You can no longer view Installed Package credentials in SFMC. 
3. Remaining Installed Packages all received the same expiry date of 09/30/2026 when they'll stop working -- unless you rotate the credentials before that point. (New credentials automatically expire 180 days from creation.)

To rotate credentials, you'll follow a pattern like this. (Validate this with your InfoSec teams now, not late-September!)

Step 1. Navigate to Installed Packages under setup about one week before the credential is set to expire.

Step 2. Click "Generate" to establish a new "staged" credential. The new credential will appear on screen but never be shown again, so capture it. After a 5-minute waiting period, the credential is LIVE. At this point, your Installed Package has an OVERLAP - two credential sets that both work. (I think "staged" is a poor word choice here by Salesforce because it implies "prepositioned" or "standing by, reading to use" - perhaps in the future we'll have the ability to schedule these and that term will make more sense.)

Step 3. SECURELY share the new credential with the vendor or developer responsible for the inbound connection to SFMC. They will need to update their code but it should work right away. (You should have no interruption in service.)

Step 4. Once they have confirmed the credential works, return to SFMC and go back to the package and click "Activate" which deactivates the old code. I recommend this over just letting the old code expire on its own. (Again, I think this is a poor word choice by Salesforce to call this "Activate" as it does nothing to your new "staged" credential except make it the only surviving credential.)

Step 5. Look at the new expiration date and go into your calendar or ticketing system and establish a reminder for just this side of 180 days to repeat the process.

Note: Unlike AWS, this cannot be performed via API (you must have the proper Roles & Responsibilities within SFMC). 

Should you do this all at once for all your Installed Packages? It depends. There may be some economies of scale, but if one or more of your implementors have problems, your time performing Customer Support could be a big distraction.

Cross-posted: https://www.linkedin.com/feed/update/urn:li:activity:7443077624660230144/ 

120: Insecure Spontaneous Unpleasant Wilderness Coffeehouse Car Valet

Ok, let's give this a shot.  Thank you https://www.dylandrakes.com/writing-prompts

• Genre: Wilderness
• Location: Coffeehouse
• Conflict: Being assigned an unpleasant task
• Occupation: Car Valet
• Positive Trait: Spontaneous
• Negative Trait: Insecure

"Oh, it wasn't that bad," Fred admitted. But then he thought about it. "Well, it sort of was. The owner was nice, but that car was an absolute mess."

Penny stirred her coffee but said nothing. 

"But yeah," Fred continued, "I maintain cars for people. Not like private-jet people, but the first-class flyers, the sailboat owning crowds." He paused and then added "Some nice cars." Was this going well? He couldn't tell.

Penny smiled, but still said nothing.

"What about you? What do you do for work?" he prompted.

Several expressions flitted across her face in rapid succession but he had trouble catching them. 

Finally, she took in a deep breath, smiled and began to talk about her job as a park ranger and Fred realized that maybe going on about cars and his rich employers might have been at odds with her experiences. But, that seemed to have broken the ice and now she was positively radiating as she spoke of her love of nature and being able to get paid to spend her time outdoors. By the time the coffee was done, they'd committed to a second date: hiking. 

And since Gary and Nelly had pushed them together for this surprise date and were sitting by the door of the coffee shop, as they were leaving Fred and Penny were quite pleased to tell Gary and Nelly it was a double-date and they had a hike to look forward to in their future.

And just for fun, here's Gemini's take with the same prompt and characters...

The smell of burnt espresso beans usually felt like home, but today the Roasted Bean felt like a cage. Fred adjusted his damp car valet vest, his hands shaking slightly—a physical manifestation of the insecure voice in his head telling him he wasn’t cut out for this.

"Change of plans," Penny barked, slamming a rusted key ring onto the counter. "The mountain pass is blocked. We’re moving the fleet through the Blackwood wilderness trail. Fred, you’re driving the lead truck."

Fred froze. The Blackwood trail was a jagged ribbon of mud and unpredictable rockslides. Being assigned this unpleasant task felt like a death sentence for someone who usually just parked sedans in level lots.

"I... I don't know the terrain, Penny," Fred stammered.

"Gary and Nelly are already at the trailhead," she countered, eyes narrowing. "Don't overthink it, Fred. Just drive."

As he stepped out of the coffeehouse, the biting wind of the high country hit him. Suddenly, his spontaneous streak—the one that usually only surfaced when ordering off-menu—flared up. He didn't check the GPS or wait for a briefing. He hopped into the lead 4x4, cranked the engine, and roared toward the treeline before his anxiety could catch up. He might be terrified of a parallel park back in the city, but out here, where the road didn't exist, he felt a strange, frantic freedom.