[retrobox]

This seems great in theory but I can’t help but think the phishing scam would evolve in to “your account has been hacked and your secret color discovered. Click here to login and set a new secret color.”

Also, let’s suppose a database of users and their associated color is compromised but that the intrusion is not immediately detected. This allows scammers to craft emails with the right color of banner leading to “but the email has the right color at the top so it can’t be a phishing scam” logic.

It may just shift the problem.