Reviewed 20 August 2026.
Why a phishing message can appear in your inbox
Email filters make probabilistic decisions to avoid blocking legitimate mail. That tradeoff means some malicious messages will reach recipients even when filtering and authentication are enabled. The UK National Cyber Security Centre advises that filtering is one layer of defence and organisations should plan on some messages getting through (NCSC guidance).
What filters and sender authentication actually check
Email defences typically combine several signal categories rather than a single test:
- Sender and infrastructure reputation and IP signals used by filter vendors.
- Message content heuristics, machine-learning models, and attachments or embedded links.
- Sender authentication records such as SPF, DKIM, and DMARC that help receivers decide how to treat mail for a domain (CISA binding operational directive on email security).
Sender authentication proves which domain or service authorised the mail but does not by itself prove a message is safe. For example, mail from a compromised legitimate account can pass authentication for that account while still being malicious.
Common reasons phishing messages evade filters
Attackers use a variety of independent techniques. Below is a compact mapping of the technique, why a filter may miss it, and what a recipient or administrator can do.
| Technique | Why filters may miss it | Action for recipients or admins |
|---|---|---|
| Compromised legitimate accounts | Mail originates from an already trusted sender address and infrastructure | Require strong authentication for sign-in and use account monitoring; report and revoke access when compromise is suspected |
| Lookalike domains and visual spoofing | Domain differs slightly from a legitimate one and may show good records for that domain | Train users to verify the full domain, use DMARC reject/quarantine where possible, and register common lookalikes for monitoring |
| Polished, personalised copy and context | Natural language and personal details reduce simple content flags | Encourage verification by known channels and use contextual anomaly detection where available |
| Image-based or attachment content | Text embedded in images can bypass textual heuristics | Enable attachment sandboxing and image inspection in the mail gateway |
| Rapidly changing infrastructure | New domains and IPs lack a reputation history | Supplement blocklists with behaviour and link-time analysis |
Practical decision framework for recipients
When you receive an unexpected or unusual message, follow this short workflow:
- Pause. Do not click links or open attachments from an unexpected message.
- Check the visible From name and the full email address. If the domain looks unfamiliar, do not rely on the display name alone.
- Verify by a known channel. Open the service or app you know is correct, or call a verified phone number rather than using contact details in the message (FTC consumer guidance).
- If the message claims urgent payment or an account change, verify the request through your organisation’s documented payment-verification steps or by a separate confirmed contact (FBI business email compromise guidance).
If you clicked a link but did not enter credentials or download files
- Close the page and do not provide any details. If the site requested a login, open the legitimate site or app directly to check your account status.
If you entered a password or other credentials
- Change the password immediately on the affected account and any other account that reused the same password.
- Enable multi-factor authentication, preferably a phishing-resistant option when the service supports it. NIST explains that some MFA methods are not phishing-resistant and recommends cryptographic authenticators for higher assurance (NIST SP 800-63B).
If you downloaded or ran an attachment
- Disconnect the device from networks if instructed by your organisation’s incident process and report to your IT or security team. Do not attempt advanced remediation unless you are the authorised administrator.
If you sent money or transferred sensitive data
- Contact your financial institution immediately and follow your organisation’s incident and fraud response steps. For business email compromise scenarios, the FBI recommends independent verification and quick engagement with banks (FBI).
Controls organisations should prioritise
Organisations need layered controls and documented processes. Key items include:
- Publish and enforce SPF, DKIM, and DMARC to reduce unauthorised mail that claims to use your domain, and configure DMARC reporting and handling appropriate to your risk (CISA BOD 18-01).
- Require multi-factor authentication and prefer phishing-resistant authenticators for high-risk accounts (NIST SP 800-63B).
- Use sandboxing for attachments and link-time analysis for URLs rather than only static allow/deny lists.
- Establish a clear payment-verification policy that mandates independent confirmation of changes to payment instructions (FBI guidance).
- Provide a simple, nonpunitive reporting process so staff can escalate suspected messages for investigation; NCSC emphasises that technical controls and a reporting culture are complementary (NCSC).
Limitations and realistic expectations
No single control will stop every phishing attempt. Authentication does not guarantee message intent because attackers may use attacker-controlled domains or compromised legitimate accounts. Filters reduce volume and many harms but cannot prevent every successful social-engineering attempt. Organisations should plan for post-click containment, recovery, and legal or regulator notifications where data or funds are affected.
Jurisdiction-specific reporting and next steps
Reporting options vary by country. Example public resources:
- United States: For consumer-facing phishing and identity concerns the FTC provides steps for victims and advice to verify by known channels (FTC). For BEC and fraud affecting businesses, the FBI recommends contacting banks quickly and reporting to IC3 (FBI).
- United Kingdom: The NCSC provides guidance on phishing defences, reporting and organisational planning (NCSC).
If you need assistance coordinating an incident response, contact your organisation’s authorised security or IT team and the relevant financial institution or public reporting service. Gacalo does not provide incident-response services. Questions about this article may be sent to contact@gacalo.com. Gacalo is operated from Somalia.
Short checklist for editors and administrators before publishing or changing mail policies
- Confirm DMARC, SPF, and DKIM are in place and reporting is enabled (CISA).
- Document a payment-verification workflow and publish a short staff-facing step-by-step guide that requires independent confirmation for payment changes (FBI).
- Require phishing-resistant authentication for privileged accounts where supported (NIST SP 800-63B).
- Maintain a one-click report-to-security mechanism in the mail client and a clear escalation path.
Frequently asked questions
Why did a message that looks clearly fake reach me?
Filters are tuned to balance blocking malicious mail and allowing legitimate messages. Messages that mimic legitimate context or come from compromised accounts can avoid simple filters. NCSC recommends a layered approach because some messages will get through (NCSC).
Does DMARC stop phishing?
DMARC helps receivers decide how to treat mail claiming to come from your domain and provides reporting, but it does not stop all phishing. An attacker can use a different domain that looks similar or a compromised account that authenticates for its own domain. CISA describes SPF, DKIM, and DMARC as part of enhanced email security (CISA).
What is phishing-resistant multi-factor authentication?
NIST explains that phishing-resistant authenticators prevent an attacker from using a disclosed secret or intercepted authenticator output to impersonate the user; not all second factors provide equivalent resistance (NIST SP 800-63B).
Conclusion
Spam filtering and sender authentication reduce risk but cannot eliminate phishing. Treat filtering as a necessary layer, not a guarantee. Combine technical controls such as SPF, DKIM, DMARC, sandboxing, and phishing-resistant authentication with simple user workflows for known-channel verification and a no-blame reporting path. If you suspect compromise, follow the consequence-based checklist above, contact your security or IT team, and engage financial institutions quickly when money or account changes are involved.
