Despite billions spent on email security gateways, phishing remains the initial access vector in the majority of breaches. Why does a solved problem keep winning? Because phishing isn’t really a technology problem: it’s a psychology problem wearing a technical disguise.
Why Phishing Still Works
Modern phishing rarely looks like the misspelled “Nigerian prince” emails of a decade ago. Attackers now:
- Research targets on LinkedIn to reference real colleagues, projects, and org charts (spear phishing).
- Compromise legitimate vendor accounts to send malicious links from trusted, previously-safe senders.
- Use urgency and authority: a fake “CEO” message demanding an urgent wire transfer (Business Email Compromise, or BEC) exploits organizational hierarchy rather than technical vulnerability.
- Abuse legitimate services like Google Docs, SharePoint, or DocuSign to host malicious payloads behind trusted domains that evade reputation-based filtering.
Case Study: The $100 Million Vendor Impersonation
Between 2013 and 2015, a fraudster impersonated a hardware vendor that two major tech companies genuinely worked with, sending convincing fake invoices over an extended period. The scheme succeeded not because of a technical exploit, but because it mimicked existing, legitimate business processes closely enough that routine approvals didn’t flag it. The lesson: phishing that mirrors real business workflows will beat almost any filter, because the fraud lives in the process gap, not the email header.
Case Study: The Cloud Storage Login Trap
A common modern pattern: an employee receives a “shared document” notification from a real, trusted cloud storage provider domain. The link is genuine: it leads to an actual hosted page. But that page presents a cloned login form that harvests credentials. Because the URL itself passes every reputation check, traditional email filtering is structurally blind to this class of attack. Only user awareness of why they’re being asked to log in again, or phishing-resistant authentication (below), catches it.
Detection: Layered, Not Singular
No single control stops phishing. Effective programs layer:
- Email authentication (SPF, DKIM, DMARC) to prevent domain spoofing: table stakes, but still not universally deployed.
- URL rewriting and sandboxing to detonate links and attachments before they reach the inbox.
- Behavioral anomaly detection flagging logins from unusual locations or impossible travel patterns after a credential harvest.
- Reporting culture: a “Report Phishing” button that’s fast and blame-free generates more real-time threat intelligence than any vendor feed.
Prevention: Where Most Programs Underinvest
- Phishing-resistant MFA (FIDO2/WebAuthn hardware keys or passkeys) neutralizes credential harvesting entirely, since a stolen password alone is useless without the physical key. SMS-based MFA, by contrast, is now routinely bypassed via SIM-swapping and real-time phishing proxies.
- Simulated phishing campaigns should measure reporting rate, not just click rate. A workforce that clicks but reports immediately is in a far better position than one that neither clicks nor reports.
- Financial process controls: for BEC specifically, requiring out-of-band verification (a phone call to a known number) for any wire transfer or payment detail change stops the fraud regardless of how convincing the email is.
Actionable Takeaways
- If you only do one thing this quarter, deploy DMARC enforcement (
p=reject): it’s free and closes the easiest domain-spoofing path. - Move MFA from SMS/push to phishing-resistant hardware keys for any account with financial or administrative access.
- Redesign your phishing training around scenarios your employees actually see (vendor invoices, shared documents) rather than generic “prize winner” templates.
- Build a verification step into every payment and credential-change workflow that can’t be satisfied by email alone.
The Bottom Line
Phishing succeeds when it exploits trust faster than your controls can verify it. The fix isn’t a smarter filter: filters will always lag creative attackers. It’s designing processes and authentication that don’t depend on a human correctly spotting deception under time pressure, every single time.