Phishing remains among the most effective attack methods in existence, appearing consistently as a leading initial access vector in security incident reports.
It persists partly because of human psychology and substantially because of a design decision made when email was created.
The original problem
The protocol that carries email between servers was designed in an era when the network consisted of a small number of trusted institutions.
Under that assumption, verifying sender identity wasn't necessary. A server said who a message was from, and there was no reason to doubt it.
The consequence is that the "from" address in an email is, at the protocol level, simply a claim. Nothing in the original design verifies it.
Which means anyone can send a message claiming to be from any address, and the receiving server has no built-in way to determine otherwise.
The bolt-on authentication
Three mechanisms were subsequently developed to address this, and understanding them explains why the problem is improved rather than solved.
SPF lets a domain owner publish a list of servers permitted to send mail for that domain. A receiving server can check whether the sending server is on the list.
DKIM adds a cryptographic signature to messages, allowing the receiver to verify the message came from the claimed domain and wasn't altered.
DMARC ties these together, letting a domain owner state what should happen to messages that fail the checks, and receive reports.
These work. Adoption is incomplete, configuration is frequently wrong, and enforcement policies are often set to monitoring rather than rejection because organisations fear blocking legitimate mail.
Why attackers work around it anyway
Even with authentication properly configured, several routes remain.
Lookalike domains. Registering a domain resembling the target — character substitutions, additional words, different top-level domains — and configuring authentication correctly for it. The message passes every check because it genuinely is from that domain.
Display name spoofing. The name shown to the recipient is separate from the address and is not authenticated. On mobile clients, which frequently show only the display name, this is highly effective.
Compromised legitimate accounts. A message from a genuinely compromised account passes all authentication because it is authentic. This is the hardest category to defend against and increasingly common.
Related domains. Using a subdomain or a domain the organisation owns but doesn't monitor.
The human layer
Technical controls reduce volume. What gets through is designed against human decision-making, and the techniques are consistent.
Urgency. A deadline, a threatened consequence, a limited window. Time pressure degrades careful evaluation, which is well established in decision research.
Authority. Messages appearing to come from senior figures, particularly requesting something unusual and confidential.
Routine mimicry. The most effective category. A message resembling something you receive constantly — an invoice, a shared document notification, a delivery update — and which you process automatically rather than evaluating.
Context exploitation. Messages timed around known events: a company announcement, a known supplier relationship, a tax deadline.
What actually reduces risk
Phishing-resistant authentication. The single most effective control. Hardware security keys and passkeys use cryptographic protocols bound to the legitimate site, which means credentials cannot be captured and replayed by a fraudulent one.
This defeats credential phishing entirely, which is why organisations that have deployed it report dramatic reductions.
Codes from an authenticator app are better than SMS and are still phishable, since a user can be induced to enter the code on a fraudulent site.
Payment verification out of band. Most financially damaging attacks involve a change of payment details. Verifying such changes by phone, using a number held on file rather than one in the message, blocks nearly all of them.
Reporting rather than training. Simulated phishing programmes have produced mixed results in evaluations, with some finding limited durable effect on click rates.
What appears more useful is making reporting easy and consequence-free, since one person reporting a campaign allows the rest to be blocked.
Programmes that punish clicking discourage reporting, which is precisely backwards.
Reducing the value of credentials. If a stolen password alone cannot access anything, the attack loses most of its value.
What individuals can do
Check the actual address rather than the display name, which on mobile requires an extra tap and is worth it for anything financial.
Never use a link in a message to reach an account. Navigate independently — type the address or use a bookmark.
Treat urgency itself as the signal. Legitimate organisations rarely require action within minutes, and the pressure is the technique.
Verify unusual requests through a different channel, using contact details you already had.
And use a password manager, which as a side effect will not autofill credentials on a domain that doesn't match — making it a surprisingly effective phishing detector.
The SMS and messaging variants
The same structural problem exists in other channels and is in some respects worse.
Sender identification in SMS is weakly authenticated, and alphanumeric sender identifiers can in many markets be set to arbitrary text. Which means a message can appear in the same conversation thread as legitimate messages from an organisation, because the phone groups by sender name.
That is a particularly effective attack, because the message arrives among genuine ones and inherits their credibility.
Registries exist in some countries requiring organisations to pre-register sender identifiers, which helps considerably where implemented. Where they do not exist, the practical advice is the same as for email: never act on a link in a message, and reach the organisation through a route you established yourself.