In September 2013, Bill Bado emailed Wells Fargo’s human-resources department, copied his regional manager, and called the company’s ethics hotline. He was a banker at a Pennsylvania branch. His email named a branch manager who had repeatedly asked him to issue debit cards, set PINs, and enroll customers in online banking without their knowledge or consent. Bado did what the training told him to do.

Eight days later, Wells Fargo fired him for tardiness.

Three years passed. The firing left a permanent mark on his securities license, scaring off prospective employers. His house approached foreclosure. He worked part-time at Shop-Rite. In September 2016, CNNMoney profiled him as one of four named ex-Wells Fargo workers who believed they had been fired for using the ethics hotline. The contents of his email – naming the manager, naming the misconduct – became part of the public record.

Bado had done exactly what Wells Fargo’s ethics training told him to do. The training was annual, mandatory, certified. Every employee completed it. It said, in language indistinguishable from the ethics training at every other major US bank: if you see misconduct, report it through the channels the training tells you to use.

The hotline turned out to be a list of names.

The cross-selling scandal broke publicly in September 2016. Internal investigations, the CFPB consent order, and the Independent Directors’ Report of April 2017 documented two distinct discipline patterns. Approximately 5,300 employees had been fired between 2011 and 2016 for opening unauthorized accounts under cross-sell quota pressure. They were the workforce the system had demanded fraud from and then disciplined for delivering it. A separate, smaller cohort – including Bado – had been fired for reporting the fraud through the ethics channels the same training told them to use. In January 2017, Wells Fargo admitted internally to “signs of worker retaliation.”

The conventional reading of Wells Fargo treats the training as fine and the workforce as the problem. They cheated on the cross-selling metrics. Bad apples. Retrain the bad apples.

The system-honest reading is the opposite. Bado used the channels. The compliance infrastructure Wells Fargo had built to satisfy its training obligations – the hotline, the email-to-HR channel, the certifications, the Vision and Values materials – was used by the same company to identify and remove the people who had taken the training seriously. The training was not wrong. The channels were not wrong as a concept. The system around them made both inoperative.

Compliance training rests on an implicit promise: if you follow what the training teaches, the system will support you. Every employee who completes an ethics module, signs an acknowledgment, watches a video about reporting misconduct is being asked to trust that promise. The promise is what makes training a credible request for behavior change rather than a piece of legal paperwork.

Wells Fargo broke the promise at scale and over years. Bado was fired in 2013, three years before the CFPB consent order. For those three years, he worked part-time at Shop-Rite while his house approached foreclosure and his securities license carried the mark Wells Fargo had put on it. For those three years, branch employees who used the channels Bado used were fired through HR processes that constructed pretextual reasons. For those three years, senior leaders watched the system work as designed.

When the workforce figures out – through colleagues’ firings, through their own retaliation, through the gap between what training says and what management rewards – that the promise is broken, the training stops being training. Completion rates stay high. Quiz scores stay high. Certifications stay signed. The channels keep ringing. Nothing the training is supposed to produce gets produced, because the system around it has made it a lie.

If you design or commission compliance training, the question this case raises is not whether the content was right. It was. The question is what the system around the training is rewarding or punishing. If those answers do not match the training’s stated goals, the training is doing something other than what its design implies. It is documenting compliance. It is protecting the company from liability. It is certifying that the workforce was told. It is not changing behavior, because behavior is not changed by training. It is changed by the system that surrounds it.

Bill Bado did everything the training asked. He still got fired. The training was not wrong. The system was.

In the summer of 2023, Congressman Don Bacon received an email from Microsoft telling him to change his password. He did not click the link. He navigated to Microsoft’s portal independently, authenticated through a channel he trusted, and changed his password there. The email looked like phishing to him.

It was not a near miss. It was Microsoft’s real notification of a real breach. About two months later, the FBI confirmed it. The intrusion had originated inside Microsoft’s infrastructure. Bacon’s account had been compromised before the notification arrived.

The cybersecurity industry reads this as a near miss. He got lucky. He instinctively did the right thing.

That is the wrong read. Bacon did not get lucky. He did exactly what twenty years of security-awareness training taught him to do. Do not click unsolicited links. Go around the link. Authenticate independently. Even if the email looks legitimate, even if it claims to come from a vendor you know, even if the tone is urgent.

He followed the training perfectly, and it did not protect him. Bacon said so himself: “The CCP hackers utilized a vulnerability in the Microsoft software, and this was not due to ‘user error.’”

Microsoft’s victim-notification email contained almost every feature security-awareness training teaches workers to treat as a red flag: urgent subject line, numbered action items, multiple links to click, language asking users to secure your account immediately. The reason it looks like phishing is that phishing spent twenty years cloning exactly this template. The mimicry was so successful that the original became suspect. Microsoft’s notification design did not evolve. The same template phishing had cloned a million times remained the official channel for telling real victims about real breaches.

The Cyber Safety Review Board’s report on the incident notes, almost as an aside, that “some victims told the FBI that they viewed authenticator application notifications as possible spam and disregarded them.” These were not undertrained employees failing a security quiz. They were people responding rationally to a notification design that had become indistinguishable from the threat it was warning about.

By the time the FBI confirmed Bacon’s breach, a five-agency interagency response – State, Commerce, CISA, the Justice Department, and the FBI – was already in operation to notify identified account holders because Microsoft’s automated notifications were not reliably reaching them. The federal government deployed a multi-agency task to do what the vendor’s notification system was supposed to do on its own.

The reflex move is to find a training fix. Train people to recognize legitimate vendor notifications. Give them a way to tell the real ones from the fakes. But what is the difference? The CSRB found none that a trained user could reliably identify. Training cannot teach a distinction the system has erased.

The right lesson is about who erased it.

For two decades, the security industry has treated phishing as a workforce problem. Train them harder. Train them more often. Run simulated phishing tests. This framing has been extraordinarily convenient for vendors, because it locates the failure in the employee and absolves the design team. Notifications still ask users to click links because clicking links is the easiest way to prompt action, and the cost of that ease falls on the workforce. Notifications are easy to clone because they were never designed to resist cloning.

Microsoft sends notifications that look like phishing because Microsoft has not been required to invest in notifications that look like anything else. The CSRB also found that Microsoft could not determine how the signing key the attackers used was obtained. The root cause of the breach remains unknown to the company that was breached.

If you run security-awareness training—through a vendor, internally, any format—this case belongs in it. Not as a story about a congressman who got lucky. As a story about what your training is actually up against.

Your training is correctly teaching your workforce to be skeptical of unsolicited security notifications. That skepticism is being deployed against a system the vendors have not updated to be distinguishable from the threats it warns about. The training is doing its job. The system is not.

Don Bacon did everything the training asked. He still got breached. The training was not the problem. The design was. And the cost of not solving it keeps falling on the people who had nothing to do with creating it.

A line worker at an electric utility cooperative was killed by a hornet swarm during substation maintenance. The OSHA investigation produced a public record of what the system around him did to make that the morning he died: a routine inspection in late August heat, an emergency response measured in twenty minutes, equipment staged too far away, time pressure that made the safe choice the slow choice. A training piece built from that record — names and locations fictionalized, investigation findings intact—sat on a shared drive and was never assigned.

The decision didn’t come down to a confrontation. It just settled. The Safety Director had recently been let go—a habit of not reading or responding to email, and the org finally moved on it. His portfolio, including safety training, folded into the Compliance Director’s responsibilities. The Compliance Director, suddenly owning a program he hadn’t designed, defaulted to what he knew: a PowerPoint deck for in-person delivery. The HR Director liked my idea. But…the org had just elevated the Compliance Director into the safety role. The political moment for overruling him on his first major delivery was not now. The file sat on a shared drive.

I’m not the first instructional designer to watch a piece of work die that way. The pattern repeats across industries and org sizes, regardless of who’s in the room: the system that should have used the work rejected it—not because anyone present was wrong, but because the structure made the conventional choice the safest one anyone could make. That is exactly the kind of failure this publication is about.

So I’m publishing it openly. No one can put it back in the drawer.

What the publication does

The piece is called The Swarm. It walks through Mike Stevens’s last morning at Heartland Electric Cooperative. Names and locations are fictionalized, but the investigation findings are real. Mike’s decisions are real. The system failures that shaped them are real.

What makes it different from a stock SCORM module isn’t production value. It’s the framing. Mike isn’t the cautionary fool who should have known better. He’s a twenty-year veteran making a defensible call inside a set of constraints his employer was responsible for shaping. The training doesn’t ask the learner to spot Mike’s mistake. It asks the learner to weigh the same trade-offs Mike weighed, before they know how it ends. Then it names what the system did to make those the only trade-offs available.

That posture has names in safety science: Just Culture, Safety-II—the framework that says human error is rarely the actual cause of adverse outcomes. The systems around human decisions are. The training discipline most workplaces buy hasn’t caught up. Most compliance training still treats the worker as the locus of failure and the organization as the disappointed parent. The certified module, the signed acknowledgment, the quiz score that proves the workforce was told—one of that is training. It’s documentation. It’s liability theater.

Trainable is the publication that makes the alternative argument, one case at a time, in the documented detail the public record provides.

The cases will come from across high-hazard sectors: cybersecurity, financial services, healthcare, education, retail, government, energy. They share a shape. A worker, trained in good faith to do something a regulator or employer instructed her to do. A worker who did it. A system around the training that betrayed the instruction, made it inoperative, or punished her for following it. A record of who lost what.

The records exist. OSHA investigation files. SEC disclosures. CSRB reports. DOJ filings. NTSB and CSB accident reports. Congressional testimony. The public infrastructure of incident documentation in the United States is enormous. It is almost entirely unused in training design.

Trainable‘s method is to take a single incident, anchor it in the public record, and tell the story closely enough that the reader feels the moment the trained behavior met the broken system. Then the structural claim—about what the system was, what it asked of the worker, and what it did to the worker—sits in plain view of the case that proved it.

What it doesn’t do

A note on what this publication does not do. It does not pretend that the politics of how training gets bought and sold are absent from the failures we examine. The cases will name budgets, procurement timelines, regulatory capture, and incentive structures where they’re load-bearing to the failure. The argument is structural; the structure includes who pays for what.

Trainable writes for the senior L&D practitioner who already knows the field is not delivering what it claims—who is tired of training that exists to document compliance rather than change behavior, and who can recognize a system-failure argument when one is made carefully.

The running argument

The running argument fits in one sentence:

Asking training to trump culture wastes everyone’s time.

The implication: training is a small intervention in a large system. The system around the training determines whether the training can do what it says it does. When it can’t — when the incentives contradict the training, when the reporting channel punishes the reporter, when the procedure hasn’t been updated for the threat — the cost of that gap does not fall on the design team. It falls on the workers who did exactly what they were taught and lost anyway.

The Swarm is the first case. There will be others.

The publication doesn’t charge for access. The work is openly published because the argument is not a product. It is a record of what training design looks like when the cost of system failure is taken seriously.

If you’ve ever built a training that the system around you made inoperative — or completed a certification while knowing it was theater — Trainable is writing in the direction of what you’ve already noticed. Subscribe if you want to know when the next case lands.