Topic starter
12/07/2026 12:15 pm
TL;DR: Phishing stays effective because attackers exploit sender names, urgency, and hidden links, according to GlobalSign. Email trust still hinges on verifying the real address and destination before action, not on the visible display name.
Editorial analysis by NHI Mgmt Group, based on content published by GlobalSign: “Termine con Phishing. Consejos para identificar emails maliciosos”.
Key questions
Q: Why do phishing emails succeed even when the content looks legitimate?
A: Phishing works because it exploits human attention, trust, and urgency.
Q: What should organisations measure to know if email controls are actually working?
A: Organisations should measure detection fidelity, containment speed, and whether suspicious messages lead to fewer successful impersonation or credential theft events.
Q: What breaks when users trust the sender name instead of the real email address?
A: Display names are easy to spoof, so trust based on the visible name alone breaks down fast.
Practitioner guidance
- Require real-domain verification for unfamiliar senders Teach users to inspect the actual email address and domain, not the display name, before they trust a message or act on it.
- Make destination checks mandatory for every link click Standardise hover or preview checks so users confirm the real URL before opening any embedded link, especially when the message creates urgency.
- Use digitally signed email for trusted business communications Adopt signed mail for messages where sender authenticity materially affects approvals, attachments, or financial action.
Bottom line: Phishing remains effective because attackers weaponise trust cues such as sender names, urgency, and familiar brand language, which can look legitimate long before a user checks the underlying identity.
Glossary terms: Phishing, Sender spoofing, Digital Signature, Link Obfuscation
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 hours ago by NHI Mgmt Group
12/07/2026 12:29 pm
Phishing is still a trust-governance problem, not just a user-awareness problem. The article is strongest when it shows that display names, familiar brands, and urgent language are all identity cues attackers can counterfeit. In governance terms, organisations fail when they treat inbox recognition as a security control instead of a signal that still needs verification. Practitioners should move from awareness-only messaging to enforceable authenticity checks.
A few things that frame the scale:
- Roughly 1 in 3 phishing payloads are delivered outside email, through channels such as social media, search ads and messaging apps.
A question worth separating out:
Q: Should teams rely on user training or digital signatures to reduce phishing risk?
A: They need both, but they solve different problems. Training helps users recognise suspicious patterns and pause before acting, while digital signatures provide cryptographic proof that a trusted sender really sent the message. Training alone is fragile; signatures alone do not stop every malicious message, but they materially improve trust decisions.
👉 Read our full editorial: Phishing detection still depends on sender trust and link checks