Email threats come in all shapes and sizes, but they are usually malicious messages meant to trick you into sending money, sharing financial details, or giving away info about a business. They range from annoying pests like spam, malware, and viruses to targeted attacks with huge financial impacts, like spear phishing, whaling, and business email compromise.
Some are so obvious they're laughable - no effort has gone into disguising a scam.
But don’t think they’re all like that. Email scams only seem to get more conniving and creative. These are the kind that even the most computer-savvy gen-zer, who grew up sleeping on an iPad, would look twice at before realizing. Where, were they not so fiendish, you might even take a step back and admire the approach. We’re going show you how to recognize phishing, and other common email scams and guard against them.
What are email threats?
Instead of trying to hack through tough digital firewalls, email threats target real people. The goal is to trick you into clicking a bad link or revealing your password. Once you do, the attackers are in prime position to steal money, install viruses on your computer, or steal your identity and move on to a bigger target.
Why do email threats exist?
Email threats exist because, despite email being one of the most popular methods of communication in the world, it is not actually that secure. Nearly every business in the world communicates via email and to contact any employee, you only need to get their email address. From there it's easy for a skilled attacker to manipulate their way inside. That’s because:
Everyone has an email address: Emails work like a public mailbox. Anyone with an internet connection can send a message directly to your phone or computer.
Email is old: The basic technology behind email was created decades ago with built-in trust. It doesn't automatically double-check if the sender is who they claim to be.
Humans are easily tricked: Attackers might pretend to be a manager demanding an urgent favor. Plus AI tools can also help scammers write believable, mistake-free messages.
Cheap and profitable: Sending millions of emails costs nothing. It only takes one person falling for the trick for the scammer to steal thousands of dollars.
Different kinds of email threats
Phishing – The most common type of email threat. Attackers send out mass emails disguised as popular brands like Netflix, Google, or your bank, to try and trick you into clicking a link that opens a fake website where you enter your password.
Business email compromise (BEC) – Scammers pretend to be a CEO, manager, or trusted business partner and try to convince someone in the finance department to wire money straight into a scammer's bank account.
Malware and ransomware – In this attack, the email carries a hidden virus. If you open the file it downloads software that steals your files or locks your entire computer until you pay a ransom.
Spoofing and impersonation – Attackers change the "From" line of an email to make it look like it came from someone you trust. They might swap letters with numbers or register domains that look almost identical to real company names.
QR Code Phishing ("Quishing") – Attackers send emails containing a QR code inside a PDF attachment.Attackers. Once you scan the code with your smartphone camera, it takes you away from computer safety tools to a fake login site where email filters can’t save you.
A quick blast from the past
Many of us remember the very early days of email scams—halcyon days when we were both more naive, but also, less trusting of emails. When we received a scam, we read it with confused interest, trying to work out why the sender would think we were the right person to come to for help.
Who remembers The Spanish Prisoner? An unfortunate soul of great wealth, who desperately needed us to help pay his ransom so he could be released from prison. Amusingly, this scam actually pre-dates email, originating in the early 19th century. A maverick Internet Surfer somewhere evidently decided to digitize it.
These days, email scams play much more to the strengths of their digital format. Unlike some of the OG scams, they utilize advantages that the Internet has come to offer over the years — like the ability to easily process payments online, an increased reliance on email for our most important communications, and the evolution of social media to name but a few.
Common signs of a phishing email
Before we take a closer look at the different types of email scams, we’re going to share some general rules you can employ to help you identify an email scam/spam — because they all share common elements — a sender, a subject line, body text, and perhaps most importantly, the need to read and believed.
Company/sender name
Look out for:
Typos or the incorrect stylization — Paypal vs. PayPal.
Something that feels overly descriptive or unlikely — AA Car Emergency vs. AA.
Companies you don’t shop/deal with — A note from Barclays when you bank with Lloyds.
Anything that seems strange — From symbols and bizarrely named companies, to strange spacing — sometimes there’s something that just feels wrong about the sender.
Sending email address
Look out for:
An incongruous email address — Something that is at odds with the company name.
Lookalikes — An address that’s designed to look like the real company. This could be the domain (@paypalcare.com) or the TLD (@paypal.club).
Errors— Typos or other irregularities in the address.
Subject lines
Look out for:
Phrases designed to provoke urgency — ‘Warning: Final payment notice’.
Over-promising language — ‘Earn £1000 in five minutes’.
Language that provokes a strong emotional reaction — ‘You’re hired! Start tomorrow!’
Typos — Con artists aren’t known for their good grammar.
Excessive use of punctuation or emojis — Few real companies use these.
The presence of ‘Re’ — Might be used to suggest you have replied before when you haven’t.
Buttons and attachments— Always refrain from clicking buttons or downloading attachments in suspicious emails.
Body text
Look out for:
Unbelievable promises— Similar to the subject line version, but there’s room for expansion in the body text which gives the opportunity to make lies more compelling.
Calls to action that seek personal information — Especially address or card details.
References to anything you don’t remember— From events to services you never received
Impersonation— Someone claiming to be a friend or relative, but they don’t sound like themselves.
Now that you have some background on how con artists can manipulate different parts of an email, let’s examine specific examples.
Types of email threats
Malware
For many, malware attacks are probably the first kind of rogue email we actually feared. Back then, we probably just referred to them as email viruses. Open it up, your screen goes black. Game over. That kind of thing.
In reality, malware covers a wide variety of malicious attacks — and some of them are, frankly, a fair bit scarier than swift computer death.
Monitoring keystrokes? Draining your CPU without your knowledge? Spying on you? Forcing dodgy ads to pop up every five minutes? Yes, malware covers a wide variety of little programs that embed themselves in your computer without your knowledge, and their functions range from things associated with nefarious pranksters to full-blown criminals. They’re evasive, and often tricky to get rid of — that’s if you know they’re there.
How to detect malware
If you’re experiencing any of the symptoms listed above, there’s a good chance it’s malware. This may have come from an email — but not necessarily. There are other ways these programs can embed themselves in your computer too — downloads, dodgy websites, and even rogue hardware devices. If you ever find a USB stick in the street, don’t see what’s on it.
Protect yourself from malware
At the risk of stating the obvious, try malware detection software. But go for something reputable.
If you Google how to prevent malware in the first place, the top advice is to install anti-virus software. Personally, I don’t know anyone who has done this since the late 2010s, but who am I to contradict the entirety of human knowledge and mass experience homogenized into a one-line answer from Gemini, served in a fraction offraction of a second?
That being said, the threat protection offered by operating systems is generally better than it was in the early days, Windows especially updates to protect against threats, but more importantly, a lot of email software is doing the work for us, by filtering out suspicious emails before they reach us.
It’s a good idea to find an email provider that promotes good protection against malware, and scans your emails before they reach you. This is particularly good when it comes to avoiding psychological attacks (and we’ll come onto those in a moment).
If we speak of protection, rather than prevention, it’s a good idea to keep regular backups, in case you are stung by one of these attacks. I personally recommend something like Mega Sync, which updates every time you hit save on a file.
Phishing
These days, you’re probably most likely to encounter an email phishing scam. Why? Because like a catchy melody, or the smell of springtime, we’re all susceptible to their charms. But how can you identify phishing?
Phishing attacks are effective because of their versatility. Sometimes it’s not hard to detect phishing. They can be anything: Literally anything that gets someone to input their personal data. Think of any reason you might feel compelled to share your personal data, or send someone money, and it has the potential to become a phishing email.
Here are just a few examples, and bear in mind, the key to phishing is that all of these emails look real, but are fake:
Password reset notification.
Fill out missing bank details.
Complete your postal address to enable delivery.
Renew your subscription.
You’re a competition winner!
A friend in need asking for help.
Tax refund notification.
Asking for charitable donations.
If you haven’t seen a phishing scam, are you even a phish? They’re so ubiquitous it's hard to imagine email without them. But there’s more than one way to phish…
Spear phishing and whaling
Spear phishing and whaling target specific individuals, often with more aggressive tactics.
Spear phishing uses personal knowledge, usually obtained from several sources, to craft more convincing emails. Because it’s written using personal information, it could reference real friends, situations, or even impersonate a bank (etc) more convincingly. If you think this feels unlikely to happen to you, do bear in mind that most people have more publicly accessible information online than they realize.
If someone posed as your friend, and referenced a very specific event that you both attended a decade ago, why wouldn’t you believe it? It might take a while to remember that you posted about it in detail on Facebook, and that the post is publicly viewable. When they ask you to borrow money, perhaps you’d lend a hand.
We are all susceptible to spear phishing, which makes it more dangerous than the more obvious scams. One fortunate caveat is that the level of research required to pull off a spearphishing scam successfully is offputting to most scammers. It’s easier to hedge their bets on a mass email that fewer people will respond to. But is that where AI will come in in the future? We need to stay vigilant.
Whaling
So, what is whaling? Well, in a lot of ways, a whaling attack is pretty much the same as spear phishing, but is specific to targeting wealthy individuals, like CEOs.
The sad reality is that their status both makes them better targets to invest time into, and other factors, (like their wealth, responsibility, lack of time, and large contact base), means there are several potential weaknesses to exploit. For example, perhaps they only need to convince a PA or secretary that they have the CEO seal of approval. So, it seems commercial whaling is always a bad thing.
How to protect against spear phishing and whaling
Beyond what is listed in our general guide above, you should also set up strong spam filtration. The human factor is really where phishing emails shine. If malware is a simple trick, then on some level, phishing requires us to be complicit. After all, we must give our information away. As we’ve discussed, it does this by appealing to our emotional response.
So ensuring we never come in contact with it in the first place is the strongest way to combat it. Spam filters look for multiple elements when considering an email that we as humans can’t. They cross-reference blacklists, known behavioral patterns, and even a method known as Bayesian filtering. This compares an email’s content with known spam vs. legitimate emails to calculate the probability that it is spam. Also, good spam filters will take into account what other users mark as spam creating what’s known as a user feedback loop.
Compromised business email
Slightly different from everything we’ve looked at so far, this comes from the opposite angle — the idea that a legitimate email account has been compromised. It needn’t be a business account, but for the sake of this entry, there are some more interesting factors to talk about if we imagine it is.
If a scammer can illegally gain access to a business email account, they can pose as workers to request funds, or even access to other internal systems that may include sensitive data.
Compromising a business account also monopolizes on another social quirk inherent in many businesses, particularly larger ones: It’s unlikely every member of staff knows everyone else. This, combined with the fact people are expected to be polite within a work environment means these emails have extra bonuses compared with private accounts.
How to protect against this
Ensuring all employees use two-factor authentication (email 2FA), and choose strong passwords greatly diminishes the risk of stolen/hacked accounts. 2FA ensures that the account holder will always know if someone tries to break in, and a strong password makes brute-force attacks harder.
You can also decrease the likelihood of future issues by immediately deactivating the accounts of employees who leave the company. A boneyard of disused accounts gathering dust is just an accident waiting to happen.
Fake invoices
One of the themes you might be noticing is the exploitation of different emotional extremities. So far we've considered the fear or carelessness of a CEO and the supposed apathy of one employee towards another. Now let's try anger.
Someone claims you owe them money, and demands immediate repayment. They're angry, they say things that make you doubt your own recollection, or create a circumstance you can’t be sure isn’t real. The vitriol and anger ensues until it almost seems easier to pay them.
This may not feel as likely for many of us, but perhaps that's the worst thing about it: The chances are, ‘we’ aren't their targets. Their success will be the vulnerable. Those who perhaps really can't remember, or are more trusting of strangers.
Prevention
If we assume that we won’t pay random invoices we get by email, it might be worth using this opportunity to suggest talking to those in your life who are less experienced online. Ask them if they need help identifying scams, and explain that just because someone is demanding money doesn’t make their claim legitimate. After all, we need to look after one another, and nobody wants to see someone walk right into an obvious scam.
There are resources you can guide people to that can take them through it in a user-friendly way.
Threat | Goal | Typical target |
|---|---|---|
Spam | Advertising/scams | Everyone |
Phishing | Credentials | Everyone |
Malware | Device infection | Everyone |
Spear phishing | Specific victim | Individuals |
Whaling | Executives | CEOs, CFOs |
Business Email Compromise | Financial fraud | Companies |
Spam vs phishing vs malware
Spam is the least dangerous of the three. Marketers and advertisers send boatloads of automated messages promoting discount deals and products. While it’s a pain to clear out of your inbox, it isn’t actively trying to steal your money or harm your computer.
Phishing, on the other hand, is much more dangerous. These emails trick you into clicking a malicious link that takes you to a fake login page designed to steal sensitive information like your usernames and passwords.
Malware often arrives disguised as an innocent attachment in an email you receive. Once opened, it can install dangerous programs on your device that record your keystrokes, steal your private files, or lock you out of your entire system.
The key difference:
Spam tries to sell to you.
Phishing tries to trick you into giving up your details.
Malware tries to infect your computer directly.
Spam | Phishing | Malware |
|---|---|---|
Unwanted messages | Credential theft | Device infection |
Protecting yourself and others
On a serious note, whether spam or scam, it’s really no laughing matter. People really get hurt, lose money, or feel stupid afterwards.
We’ve suggested several ways to protect yourself, but it really boils down to three things:
Enable as much security as you can
Whatever your provider offers, whether it’s 2FA, automatically generated passwords, or even encryption — you name it. Set these up. They just make your account a little bit more difficult to hijack.
Choose a security-minded provider
A provider with strong spam management software and frequent security updates is probably your best form of ongoing protection as a business. Most of the scams we’ve outlined begin and end with spam management. If we never see them, they’re never an issue.
Keep your finger on the pulse
Phishing scams never stop evolving. They target you, not your inbox, so you are your own best defense.
Are there any practices you use to avoid falling for spam and scams? We’d love to hear them! Leave any thoughts or questions in the comments section below
Frequently asked questions
Phishing is an email attack where scammers impersonate trusted companies or individuals to trick you into taking action. These actions typically involve revealing passwords, sharing financial details, or sending money directly to the attacker.
Spam consists of unwanted, automated bulk messages primarily sent to advertise products or services. While spam is mostly an annoying nuisance, phishing is a malicious security threat specifically designed to steal sensitive information or money.
Look for incongruous sender email addresses, poor grammar or typos, urgent or threatening language, and links that point to fake web domains. Be extremely cautious of unexpected attachments or demands for personal information.
Malware in email refers to malicious software delivered through rogue attachments or links. Once opened or downloaded, it can install viruses, ransomware, or spyware on your device to record your keystrokes, steal files, or lock system access.
Spear phishing is a highly targeted form of phishing that uses personalized information about a specific individual to craft a customized, believable email. Attackers research their target beforehand to make their request seem authentic.
Whaling is a specialised type of spear phishing targeting high-profile individuals, such as CEOs, CFOs, or business owners. Scammers target these high-net-worth executives because the potential financial payoff is much larger.
Business email compromise occurs when an attacker hacks or spoofs a legitimate company email account. The scammer then poses as an executive or trusted partner to convince employees to wire corporate funds or share internal data.
Using a security-minded email provider with a strong spam filter will stop most malicious messages before they ever reach your primary inbox. Combining good spam filtration with two-factor authentication and healthy online skepticism is the best way to guard against threats.
If you entered financial details, immediately contact your bank to freeze affected cards or accounts. Next, change your passwords for all compromised accounts and run a full security scan on your device to check for malware.
Suggested articles
Comments (2)
Lily Simon
Aug 9, 2025
Olha Nesen. Product and Marketing Coordinator
Aug 13, 2025