Email Phishing Deep Dive

Email Phishing Deep Dive

Photo by Solen Feyissa on Pexels

Email phishing is the original and still the most common form of phishing attack. Understanding its mechanics in detail — how attackers craft messages, spoof senders, and evade filters — will sharpen your ability to spot even sophisticated attempts.

Anatomy of a Phishing Email

Every phishing email has five components. Learning to inspect each one systematically is your defense routine.

1. Sender Address: The "From" field is the first red flag. Attackers use display names that look real ("IT Support") but pair them with email addresses that do not match. An email from "Microsoft Support" sent from "support@microsoft-verify.com" is suspicious — Microsoft sends from microsoft.com. Check the actual email address, not just the display name, by hovering over or clicking the sender's name in your email client.

2. Subject Line: Phishing subjects create urgency, fear, or curiosity. "URGENT: Account Suspension," "Action Required," "Your Package Could Not Be Delivered," or "You Have a New Document to Review" are common patterns. Legitimate organizations typically use specific, informative subject lines.

3. Email Body: The body contains the manipulation — urgency, authority, or a compelling offer. Look for generic greetings ("Dear Customer" instead of your name), spelling and grammar errors (though modern phishing is often well-written), and requests that do not match the supposed sender's normal behavior.

4. Links and Buttons: The link text may say "Click here to verify your account" but the actual URL points somewhere else. Hover over any link before clicking to see the real destination. A link claiming to go to your bank but pointing to "secure-bank-verify.net" is a phishing attempt.

5. Attachments: Malicious attachments often carry double extensions ("invoice.pdf.exe") or unusual file types (.iso, .img, .htm). Never open an attachment you were not expecting, even if it appears to come from someone you know.

How Attackers Spoof Sender Addresses

Email was designed in the 1970s with no built-in sender authentication. Attackers exploit this through email spoofing — sending emails that appear to come from a different address. Modern email servers use SPF, DKIM, and DMARC records to verify senders, but these are not universally enforced. This means a carefully crafted email can appear to come from your CEO or a trusted vendor, even though it originated from an attacker's server.

Free Tools for Email Verification

• MxToolbox (mxtoolbox.com) — Free tool to check email headers, verify SPF/DKIM/DMARC records
• Google Messageheader Analyzer — Paste email headers to trace the true origin of an email
• MailCheck by Agari — Free browser extension that analyzes email authentication in Gmail and Outlook

A Real-World Scenario

A small accounting firm received an email from "QuickBooks Support" notifying them of an "unusual login attempt." The email looked perfect — Intuit logo, correct formatting, professional language. It asked them to click a link to "secure their account." The link pointed to "quickbooks-secure-login.com" — a domain registered three days earlier. One employee clicked and entered their credentials. Within hours, the attacker had accessed the firm's client data. The firm learned the hard way that checking the sender domain and link URL takes five seconds and saves five million in potential damages.

Key Takeaways

• Inspect every email systematically: sender address, subject, body, links, and attachments
• Hover over links to see the real URL before clicking
• Email spoofing means the "From" field can be faked — verify through a second channel if anything seems off
• When in doubt, do not click — contact the sender through a known, trusted method

Common Questions: Email Phishing Deep Dive

Q: What free tools can help verify email legitimacy?
Several free tools are available: MXToolbox (mxtoolbox.com) lets you check email headers, SPF, DKIM, and DMARC records. Google Messageheader Analyzer helps parse complex email headers. VirusTotal (virustotal.com) can scan suspicious URLs and attachments against 70+ antivirus engines. Have I Been Pwned (haveibeenpwned.com) checks if your email address appears in known data breaches. These tools are free and should be part of every employee's phishing investigation toolkit.

Q: What happens if my organization doesn't implement email authentication (SPF, DKIM, DMARC)?
Without these protections, anyone can spoof your domain and send emails that appear to come from your company. This means attackers can impersonate executives, trick customers into paying fake invoices, and damage your brand reputation. Customers who receive spoofed emails from your domain may lose trust, file complaints, or switch to competitors. Implementing SPF, DKIM, and DMARC is free and should be a baseline security measure for every organization.

Q: How can I check email headers in common email clients?
In Gmail, click the three dots next to "Reply" and select "Show original." In Outlook, double-click the email to open it in a new window, then go to File > Properties > Internet headers. In Apple Mail, select View > Message > Raw Source. The headers reveal the true sending path, authentication results, and originating IP address. Look for "Received" lines to trace the email's journey and "Authentication-Results" to check SPF/DKIM/DMARC status.

Q: What is a "beam phishing" attack?
Beam phishing is a targeted variant where attackers send emails to a broad group within a single organization, often using a compromised internal account. Because the email comes from a legitimate internal address, it bypasses many email filters. The attacker typically includes a link to a fake login page or a malicious attachment. This makes internal email security awareness critical—just because an email comes from a coworker doesn't mean it's safe.