Why do phishing and BEC still get through stacked mail filters?

Why stacked mail filters still miss phishing and BEC

Mail filtering is strongest when the attack is noisy, repetitive, or clearly malicious at the content layer. Phishing and business email compromise often evade that model because they exploit trust, context, and workflow timing rather than obvious malware. A message that looks routine, uses a believable sender relationship, and arrives at the right moment can still be the one that reaches the business process that matters.

What the filter stack is actually optimised to catch

Many email security layers are designed to spot signatures, reputation hits, malicious links, attachments, and known phishing patterns. That is useful, but it means the stack is often better at blocking commodity spam than low-volume impersonation, invoice fraud, or an account-abuse message crafted to look like normal business traffic. The more the attacker blends into legitimate communication patterns, the less useful simple bad-content detection becomes.

Phishing and BEC also exploit the fact that mail is only one control point in a wider workflow. If a message passes filtering and lands in a shared inbox, finance queue, or executive thread, the technical control has already lost most of the battle. That is why trusted sender history, reply-chain abuse, and brand impersonation can be more effective than payload-based attacks.

Stacked filters can still help, but they are not a complete answer when the adversary is targeting human decision-making. A layered stack may reduce volume and stop known threats, yet it cannot reliably judge whether a request is socially believable, financially urgent, or internally consistent with an ongoing relationship.

Why trusted identity cues beat malware-style detection

BC attacks typically borrow legitimacy from sender identity, display names, domain lookalikes, compromised mailboxes, or conversation hijacking. That shifts the problem from “is this message malicious code?” to “is this request from the right actor, in the right context, with the right authority?”Email Identity and BEC Guide is useful here because it shows why SPF, DKIM, DMARC, mailbox takeover controls, and payment verification matter as a set rather than as isolated checks.

This is also why compromise paths matter more than volume. Attackers do not need every mailbox; they need one message that lands in a trusted workflow. Once they obtain that foothold, they can request wire changes, vendor updates, payroll diversion, gift card fraud, or credential resets with far less friction than a traditional malware campaign would require.

In some cases, the attack even starts outside the inbox and comes back in through a trusted account. A compromised vendor account, cloud email permission, or phishing-resistant but socially engineered approval path can give the attacker enough credibility to bypass message content scrutiny entirely.TruffleNet stolen AWS keys campaign 2025 illustrates how stolen credentials can be used to validate access and then send a convincing fake invoice from a legitimate-looking position.

Where layered controls help, and where they stop

The best mail stack is still worth having, but its job is to reduce exposure, not to prove intent. Stronger authentication for mail transport and sender identity, tighter mailbox permissions, and controls over high-risk actions such as payment changes or external forwarding raise the cost of abuse.Email Identity and BEC Guide is the most direct example of how email authentication and payment verification reinforce each other.

What the stack cannot do well is infer business legitimacy from a message alone. A filter may confirm that a message came from a technically valid source, but it cannot tell whether the request is authorized, whether the relationship is being spoofed, or whether the sender account is already compromised. That is why BEC remains effective even in organisations with mature spam and phishing protection.

Good defensive design assumes the attacker will eventually get one believable email through. The important control question is then whether the downstream process has enough verification, separation of duties, and exception handling to stop the action from succeeding. In practice, the mail filter is only the front door; the business workflow is where the loss usually happens.Dropbox GitHub breach 2022 is a reminder that one phished identity can expose much more than a single mailbox.

Risk and Threat Considerations

Phishing and BEC remain effective because the real target is usually trust, not spam volume. When organisations rely on filter strength alone, they leave the approval chain, payment process, and mailbox permissions as the primary attack surface.

Failure mechanism: The attacker uses a believable sender identity, compromised account, or conversation context to bypass content-based detection and trigger a human or business workflow decision that the mail system cannot validate.

Impact: A single accepted message can lead to invoice fraud, credential theft, mailbox takeover, vendor payment diversion, or broader account abuse, even when the message never carried a traditional malware signature.

Practitioner Guidance

What to prioritise: Treat verification of high-risk business actions as separate from email delivery security. If a message can initiate a payment, password reset, bank detail change, or external forwarding rule, require a control that does not depend on the inbox alone.

What to verify: Check whether your email controls actually validate sender identity, block lookalike domains, detect mailbox takeover, and protect the downstream workflow. If those four are not jointly covered, the stack is likely giving more assurance than it deserves.

Common mistake: Teams often assume that “passed spam filter” means “safe to trust.” For BEC, the correct question is whether the request is independently verified, not whether the message was technically delivered cleanly.

Practitioner takeaway: The goal is not to make every suspicious email disappear, but to make sure one believable email cannot move money, credentials, or access without an out-of-band control that the attacker cannot also impersonate.

Related resources from NHI Mgmt Group

• Why do phishing-resistant MFA methods matter if attackers can still get in?
• Who is accountable when password policy exists but weak passwords still get through?
• Why do authenticated phishing emails still fool users and filters?
• Why do phishing and BEC still require layered controls instead of one AI model?