3 out of 4 phishing scams get to your inbox untouched

August 3, 2019 TH Author

Username and password written on a paper note in the shape of a fish attached to a hook - Phishing and internet security concept

Does it still stink?

Getty Images/iStockphoto

Apple sends me so many invoices every week that I scarcely know what I’ve gone and bought.

Then there’s the constantly cheery emails I get from apparent relatives who want me to keep large sums of money for them. Just for a few days.

Occasionally, I wonder why Microsoft — I still proudly rock my Hotmail — Apple and Google aren’t blocking more of such phishing messages.

This appears to have also crossed the minds of researchers at the UK’s University of Plymouth.

The wise wonderers at the university’s Center for Security, Communications and Network Research thought they’d try and become phishers themselves.

So they grabbed some sample email formulations from phishing attacks of the past and sent them to specific email addresses.

Some of these phishing emails had links, others didn’t.

Would they be blocked? Would they at least be marked as suspicious?

Would fish make excellent world leaders?

The results were truly painful. A fulsome 75 percent of the linkless messages wafted straight through to inboxes. A hearty 64 percent of the ones enjoying links also sailed in without so much as a passport check.

Professor Steven Furnell, the Center’s leader, offered a dim view of email providers.

He said: “The poor performance of most providers implies they either do not employ filtering based on language content, or that it is inadequate to protect users. Given users’ tendency to perform poorly at identifying malicious messages, this is a worrying outcome.”

We’re told that technology has such a large brain these days. It can (allegedly) recognize a human face, predict your propensity to commit a crime and even make President Obama say things he didn’t.

It seems less able, however, to spot that A. Harland O’Mali Whitebait is not a real name. Nor that, even if it was, the email address associated with it wouldn’t be mailbox50990@abangabobby.

Equally, technology struggles to notice that a message reading: “My dear, your inheritance is to arriving here fast and soon. Please allow remittance details” isn’t likely to come from anyone who is actually related to you, knows you or would even ever want to send you money.

Could it be, perhaps, that many of the largest email providers just don’t care?

After all, have you ever tried to get any sort of customer service from most of them? I tried with Microsoft once and was offered lots of unhelpful pre-prepared FAQs and a complete inability to contact an actual human being.

As my colleague Danny Palmer recently reported, the most common form of phishing threat in your inbox is the personal impersonation.

Of course users should have become more adept at noticing when an email is an evil fake.

You might think, though, that tech companies would have used their sophisticated systems to learn the clumsy wordings of so many of these scammers and made sure that none of these fakes ever reaches their customers’ eyes.

After all, I actually pay Microsoft for my Hotmail, yet many of the phishing emails don’t even get labeled as junk.