Why do phishing and impersonation attacks still succeed when Safe Links and Safe Attachments are enabled?

Why Safe Links and Safe Attachments Reduce, but Do Not Eliminate, Phishing Success

safe links and Safe Attachments narrow the attack surface, they do not replace user verification or identity controls. Phishing still succeeds when the lure depends on brand impersonation, urgency, callback pressure, QR-code routing, or consent abuse rather than a malicious URL or attachment. The residual risk is often social, not purely technical, so the control must be interpreted as one layer in a broader defence.

That is why phishing guidance has to cover the whole chain, not just the payload. A message can look legitimate, pass link rewriting, and still push a user into handing over credentials, approving an OAuth prompt, or opening a support workflow the attacker can exploit. The relevant issue is whether the organisation can verify intent and trust at the point of action, not only whether the email scanner blocked a known-bad object.

For practical coverage of the common lure paths that remain after mailbox protections, see Phishing Guide and the broader Top 10 Phishing Techniques, which map the techniques that bypass a simple attachment-or-URL view of the problem.

Where the Control Boundary Actually Stops

Safe Links is strongest when the attacker needs the victim to click a malicious URL after delivery. Safe Attachments helps when the threat is embedded in a file that can be detonated or inspected. Neither control can fully judge whether the sender is impersonating an executive, a vendor, a help desk, or a shared service, because that trust decision lives above the message object.

That boundary matters because modern phishing often abuses a trusted channel rather than a technically malicious artifact. A convincing login page, QR code, reply-chain hijack, or consent prompt can succeed even when message security controls are active. In those cases the control may work as designed and the organisation still loses, because the failure is in human trust calibration and identity verification.

For mailbox and tenant hardening that complements these protections, the Microsoft 365 Security Guide is the relevant internal reference for configuration, auditability, and identity-aware policy around Microsoft 365 protections.

What to Add When You Need Coverage Beyond Email Filtering

Residual phishing risk drops when organisations pair mail controls with identity-aware policy, strong session handling, and out-of-band checks for high-impact actions. The important design question is whether a user can be tricked into a decision that the email gateway cannot evaluate, such as approving access, resetting credentials, releasing payment, or authorising an application.

Practitioners should also assume that credential theft is only one possible outcome. If the lure leads to token theft, consent abuse, or inbox-rule persistence, the organisation needs detection and response that can revoke sessions, purge mailbox artefacts, and review delegated access quickly. That is why incident playbooks matter even when the original email was technically filtered or quarantined.

When the failure mode is impersonation rather than a malicious file or link, the strongest defensive pattern is behavioural verification. Use callback procedures, verified contact paths, and step-up approval for sensitive requests so the security decision does not depend on the authenticity of the sender display name alone. For those attack styles, Deepfakes, Social Engineering and AI Impersonation Guide and Vishing and Smishing Guide are useful complements because they focus on the verification step attackers are trying to bypass.

Risk and Threat Considerations

Phishing succeeds when the defender assumes the mailbox control is the whole control. Attackers can route around URL scanning and attachment detonation by using impersonation, QR codes, reply-chain abuse, or OAuth consent, then converting trust into credentials, tokens, or a business action.

Failure mechanism: The control checks a message object, while the attacker targets the human decision or downstream identity action. If the lure is delivered through a trusted-looking sender, a clean attachment, or a benign-looking link that later changes destination, the technical inspection can pass and the compromise still occurs.

Impact: The organisation gets a false sense of coverage, slower detection, and higher likelihood of credential theft, session theft, or fraudulent approval. In mature environments, the damage often comes from what the victim authorised after the message passed inspection, not from the message itself.

Practitioner Guidance

What to verify: Treat Safe Links and Safe Attachments as baseline controls, then verify whether your high-risk workflows still depend on email trust. If finance, help desk, admin, or identity actions can be completed from a single message without a second-channel check, the residual risk is still too high.

What good looks like: The organisation can explain which lures are blocked technically, which are blocked procedurally, and which require user or identity-layer verification. Good coverage is visible when suspicious mail triggers monitoring, step-up checks, and response actions rather than being handled as a binary deliver-or-block decision.

Practitioner takeaway: Email security controls reduce exposure, but they do not authenticate intent, so the real test is whether an impersonation attempt can still trigger an action with business impact.

Related resources from NHI Mgmt Group

• Why do man-in-the-middle attacks still succeed when HTTPS is enabled?
• Why do AI-driven phishing attacks still succeed when organisations use modern authentication?
• Why do phishing attacks still succeed even when people know the warning signs?
• Why do phishing attacks still succeed in well-defended environments?