What Email Filters Catch, and What They Miss
Email filters stop a huge amount of phishing, but some always gets through. How filters decide, the gaps attackers aim for, and why a message in your inbox is not proof it is safe.
Your email provider filters out enormous amounts of spam and phishing before you ever see it. That makes it easy to assume that anything left in the inbox has been checked and approved. It has not. Filters make decisions based on patterns, and attackers design messages to avoid those patterns.
What filters look at
- Sender reputation: is this domain or server known for sending junk?
- Authentication: do SPF, DKIM and DMARC checks pass? See email authentication explained.
- Links and attachments: are they known to be malicious?
- Content and volume: does the message match known campaigns sent to many people?
The gaps attackers aim for
- New domains and pages that have no bad reputation yet.
- Hacked real accounts, which pass every sender check.
- Trusted services: links to genuine file-sharing, form or document sites. See document share phishing.
- No link at all: a plain request to call a number or reply. See callback phishing.
- Small, targeted sends to one person, which look nothing like a mass campaign. See spear phishing.
- Images and QR codes instead of text links. See QR code phishing.
The inbox is not a seal of approval. Judge each unexpected request on its own merits, however it arrived.
Help the filter help you
- Use the report phishing or report spam button rather than just deleting.
- Keep your provider's built-in protection switched on.
- At work, use the report button your organization provides. See why report buttons matter.
Unsure about something that made it to your inbox? Paste it into CyberWatch AI Scan for a free check.
For the full picture, see how to protect yourself from phishing.
Frequently asked questions
If an email reached my inbox, is it safe?
No. Filters reduce phishing but cannot catch everything, especially new, targeted or low-volume messages.
Should I check my spam folder?
Occasionally, for legitimate mail. Treat anything in spam with extra suspicion and do not click links there to test them.
Does marking emails as spam help?
Yes. Reports and spam marks help your provider learn and protect other users.
Sources
- Phishing attacks: defending your organisation, UK National Cyber Security Centre
- Suspicious email actions, UK National Cyber Security Centre
- Recognize and Report Phishing, US Cybersecurity and Infrastructure Security Agency
