There are checks in place to make difficult to buy an SSL certificate for the official domain of a bank.

At least Chrome tracks malicious websites.

By comparison, there seem to be no checks in place to prevent writing an ethereym contract that drains a victim’s wallet.

> There are checks in place to make difficult to buy an SSL certificate for the official domain of a bank.

Who said it needed to be a real bank?

> At least Chrome tracks malicious websites.

That's not TCP/IP, the chrome equivalent would be on Trustwallet, argent, metamask etc to implement.

The ACH banking protocol doesn't have these either.

This isn't Ethereum's job.

It's an L2's job. Whichever ones you choose to engage with. But, they'll all be interoperable.

Anyone that's sent crypto from Polygon to Coinbase would disagree about interoperability.

Polygon is a centralized project, and its problems are its own. Not a decentralized cryptocurrency.

There a number of services that provide blacklisted addresses to help people avoid scams or to prevent stolen funds from being laundered.

Actually most web3 wallets have their own version of "safe browsing" and track malicious/phishing web3 websites.

There isn't much point if domains and contracts are being setup for the sole purpose of spearfishing a handful of whales.

Alright, then same goes for the parent comment within the context of spear phishing...

I never said I expect ethereum or web3 or whatever to be entirely scam free. I said that having the ability to send anyone any transaction and to their eyes have it look like any other sort of interaction they like unless they can read solidity and audit the code themselves is a very very large security hole.