Email Phishing Protection: How to Prevent Attacks (2026)

Email phishing is the use of fraudulent email to trick people into revealing passwords, paying fake invoices, or installing malware — and it remains the single most common way organisations are breached. Defending against it takes two things working together: technical controls that stop attackers impersonating trusted senders, and people who can spot the messages that slip through. This guide explains what email phishing is, the main types of attack, and how to build real email phishing protection. It is part of our email security hub.

What is email phishing?

Email phishing is a social-engineering attack delivered by email, in which a criminal poses as a trusted person or organisation to manipulate the recipient into a harmful action — clicking a malicious link, entering credentials on a fake login page, opening a weaponised attachment, or wiring money. It works by exploiting trust and urgency rather than technical flaws, which is why even well-secured systems fall to it. Most email phishing relies on spoofing or lookalike domains to make the message appear legitimate, so the sender looks like your bank, a colleague, or a familiar brand.

Types of email phishing

The more targeted an email phishing attack, the more dangerous it is — a well-researched spear-phishing or BEC message can be almost indistinguishable from a genuine one, which is why technical controls matter so much. You cannot rely on people alone to catch every attack.

How to prevent email phishing

Effective email phishing protection is layered. No single control catches everything, so you combine technical defences with human awareness:

• Authenticate your own domain. Deploying DMARC at p=reject stops criminals from sending phishing that appears to come from your domain, protecting your customers and staff alike.
• Filter inbound mail. A secure email gateway or your provider’s built-in protection scores and quarantines suspected phishing before it reaches inboxes.
• Enforce multi-factor authentication. Even if credentials are phished, MFA blocks most account takeovers.
• Train your people. Regular awareness training and simulated phishing build the habit of checking sender addresses and pausing on urgency.
• Verify out of band. For any payment or credential request, confirm through a separate channel — a phone call, not a reply.

The technical half and the human half reinforce each other: authentication and filtering cut the volume of phishing that reaches people, and training catches the targeted messages that get through. Guidance from agencies such as the US Cybersecurity and Infrastructure Security Agency consistently recommends exactly this layered approach.

How to recognise an email phishing attack

• Mismatched sender. The display name says one thing but the actual address is unrelated or a lookalike domain.
• Urgency and threats. “Your account will be closed in 24 hours” pressures you to act before thinking.
• Unexpected links or attachments. Hover to see the real destination; be wary of login pages reached from an email.
• Requests for credentials or payment. Legitimate organisations rarely ask for passwords or sudden wire transfers by email.
• Subtle errors. Odd grammar, slightly wrong logos, or an address like support@paypa1.com.

Teaching everyone in your organisation these signs is the human layer of email phishing protection, and it is the backstop for the targeted attacks that technical filters miss.

Phishing and your domain’s reputation

There is a deliverability dimension to phishing protection too. When criminals spoof your domain to send phishing, the resulting complaints and blocks can damage your domain’s sender reputation, hurting the deliverability of your genuine mail. Deploying authentication to stop spoofing therefore protects both your security and your inbox placement — the same DMARC enforcement that blocks phishing in your name also reassures mailbox providers that your mail is trustworthy. Security and deliverability are, once again, two sides of the same coin.

Why email phishing keeps working

Email phishing persists as the leading cause of breaches for a simple reason: it attacks people, not machines. Every other security control can be hardened, but a well-crafted message that exploits trust, authority or urgency can still convince a busy human to click. Attackers have also industrialised the craft — phishing kits, stolen branding and, increasingly, AI-generated copy let them produce convincing, error-free lures at scale and personalise them with details scraped from social media. The old advice to “look for bad grammar” is no longer enough, because the messages have got better. That is exactly why technical controls that remove the easy impersonation routes are so valuable: if a criminal cannot spoof your exact domain, they are forced onto lookalike domains and display-name tricks that are easier for both filters and people to catch.

The economics also favour the attacker: sending a million phishing emails costs almost nothing, and a single success can be hugely profitable, especially with business email compromise targeting payments. Defence therefore has to be about reducing the odds across many attempts rather than achieving perfection on any one — cut the volume that reaches inboxes through authentication and filtering, and cut the success rate of what gets through with training and verification habits.

Building a phishing-resistant culture

Technology buys you a great deal, but the organisations that resist email phishing best also build the right habits. The most effective is a blame-free reporting culture: people should feel safe reporting a suspicious message — or even admitting they clicked — without fear of punishment, because early reporting is what lets security teams contain an incident before it spreads. Regular, realistic simulated-phishing exercises keep awareness fresh and turn “check the sender address” into reflex rather than a poster on the wall. And a firm, well-known policy that no payment or credential change is ever actioned on the strength of an email alone removes the single most lucrative target for business email compromise.

Pair that culture with the technical foundation and you have genuine resilience. Multi-factor authentication ensures that even a successful credential phish rarely leads to account takeover; domain authentication via DMARC stops your brand being used as the bait; and inbound filtering removes most attempts before anyone sees them. None of these is sufficient alone, but together they make your organisation a hard, unrewarding target — which, given the economics, is often enough to send attackers looking elsewhere. For the domain-forgery technique that underpins most phishing, see our email spoofing guide.

What to do if you fall for a phishing email

Even with strong defences, someone eventually clicks — so knowing how to respond limits the damage. If you entered credentials on a fake login page, change that password immediately, and change it anywhere else you reused it; then sign out all active sessions and, if it is not already on, enable multi-factor authentication so a stolen password alone is not enough. If you opened an attachment or your device behaves oddly, disconnect it from the network and run a security scan rather than hoping for the best. And in every case, report the incident to your IT or security team at once: speed is decisive, because the difference between a contained click and a full breach is often measured in minutes, not hours.

If the phishing involved a financial transaction — a redirected payment or a fraudulent invoice — contact your bank or payment provider immediately, as funds can sometimes be recalled if you act fast enough, and report it to the relevant authorities. The instinct to stay quiet out of embarrassment is the attacker’s best friend, which is exactly why a blame-free reporting culture matters so much: an employee who reports a click in the first five minutes is protecting the organisation, and should be thanked, not punished. Build that expectation in advance and your worst-case outcomes get dramatically better. For the domain-level defences that stop your brand being used in these attacks, see our email spoofing and DMARC guides.

Check it yourself: use our free email tools to look up any domain’s SPF, DKIM and DMARC records — the controls that stop your brand being used in phishing.

Related reading

• Email spoofing explained
• Email encryption guide
• S/MIME email encryption guide
• PGP email encryption guide
• S/MIME vs PGP comparison

Email phishing FAQ

How can I prevent email phishing in my organisation?

Combine technical and human defences: authenticate your domain with DMARC at enforcement, filter inbound mail through a secure gateway, enforce multi-factor authentication, train staff to spot phishing, and verify payment requests out of band. No single measure is enough, but together they prevent the large majority of attacks.

Does DMARC stop email phishing?

DMARC at p=reject stops phishing that impersonates your domain, protecting your customers and staff from messages forged in your name. It does not stop inbound phishing from other domains, so you still need inbound filtering and user awareness for messages aimed at your own people.

What is the difference between phishing and spear phishing?

Phishing usually means mass, generic messages sent to many people, while spear phishing is targeted at a specific individual using personal details to seem credible. Spear phishing — and its executive-focused form, whaling — is far harder to detect and is the basis of most business email compromise.

What is business email compromise?

Business email compromise (BEC) is a targeted email phishing attack in which a criminal impersonates an executive or supplier to trick an employee into authorising a payment or sharing sensitive data. Because BEC often uses spoofing or lookalike domains and contains no malware, it evades many filters — which is why domain authentication and out-of-band payment verification matter.

How do I report a phishing email?

Use your mail client’s “report phishing” button, which sends the message to your provider for analysis, and notify your IT or security team if it targets your organisation. Do not click any links or reply; if you may have entered credentials, change the password and alert IT immediately. Reporting genuinely helps beyond your own inbox, because providers use those reports to tune their filters and protect other recipients from the same campaign — so the few seconds it takes to report a phishing email are well spent even when you were never going to fall for it.

Can email phishing be stopped completely?

No defence is perfect, but a layered approach — domain authentication, inbound filtering, MFA and trained users — prevents the vast majority of attacks and limits the damage of any that succeed. The goal is to reduce both the number of phishing emails that arrive and the chance that one which does will succeed. Think of it as raising the cost and lowering the payoff for attackers until your organisation is no longer a worthwhile target: each layer removes a class of attack, and the combination is far stronger than any single control, which is why mature security programmes invest across all of them rather than betting everything on one tool or one training session.