Phishing

Phishing is a deceptive message intended to make someone reveal sensitive information, send money or install harmful software. An attacker may impersonate a company or colleague, or use an account that has been compromised.

An illustrative SaaS example is a message claiming that a workspace will be deleted unless its owner signs in immediately. A familiar logo and sender name do not establish that the request came from the product.

Check the request through a known route

If an unexpected email asks you to open an attachment, enter credentials or change payment details, open the service through a bookmark or an address you already know. Check the account there or contact the organization through a trusted channel. Avoid using contact details supplied only in the suspicious message.

The FTC’s phishing guidance recommends verifying unexpected requests independently and using multi-factor authentication. Report suspicious messages through your mail provider or your organization’s security process. If you already disclosed credentials, contact the service through its official recovery route and secure the affected account.

What email authentication can establish

SPF and DKIM provide domain-related authentication signals. DMARC checks alignment with the domain in the visible From address and lets a domain owner publish a policy for failures. These controls help receivers evaluate use of your domain.

They do not prove that a message is harmless. An attacker can use a different domain with a familiar display name, or send from a compromised account. The DMARC specification’s discussion of display-name attacks explains why passing authentication does not settle who the reader thinks the sender is.

Make legitimate product email easier to verify

Use a consistent sender identity and recognizable destinations. Explain why an account notice was sent and give the recipient a way to check the same issue inside the product. Avoid requesting passwords or one-time login codes in replies.

For a billing notice, for example, tell the customer where to find billing settings after signing in independently. Keep promotional material out of urgent security notices so the purpose is clear. Give users a documented route for reporting impersonation.

Review authentication for your sending domain, but test the whole message as a recipient would see it: sender name, address, subject, links and destination. Good authentication and clear account instructions address different parts of the problem.

Related reading

SPF · DKIM · DMARC · Email authentication