Why do phishing campaigns continue to target payment services, financial firms, and SaaS/webmail providers even when overall report volumes fall?

Why the Targeting Persists Even When Total Volume Drops

Phishing volume can fall while attacker effort becomes more selective. Payment services, financial firms, and SaaS or webmail providers still attract campaigns because they sit close to monetisable accounts, customer trust, and credential reuse. The adversary does not need to flood every inbox if a smaller, better timed campaign can capture high-value logins, payment flows, or token access.

That shift matters operationally because a lower report count can hide a higher conversion rate. The risk is not just “more phishing,” but phishing that is better matched to the sector, brand, and workflow the attacker wants to abuse. Sector concentration is therefore often a sign of optimisation, not retreat.

What Makes These Sectors High-Value Targets

These sectors sit on three especially valuable assets: identity, money movement, and trust relationships. Payment and financial platforms can turn access into direct fraud or downstream compromise, while SaaS and webmail accounts often provide the fastest route into business communications, reset flows, and shared services. Attackers follow the path where one set of stolen credentials can unlock multiple opportunities.

Brand impersonation also works better here because users already expect to receive login prompts, account notices, payment alerts, and MFA prompts from these providers. A convincing lure does not need to be broadly successful if it only needs to catch a small number of high-value users. That is why these campaigns are often narrowly themed around account verification, invoice issues, sign-in problems, or payment exceptions.

What Security Teams Should Watch When the Noise Drops

Low volume should not be treated as a comfort signal. Teams should watch for concentration in a small set of industries, repeated impersonation of the same brands, and suspicious clustering around password resets, MFA prompts, OAuth consent, or webmail sign-ins. In practice, financial-services identity security guidance is most useful when it is used to prioritise the accounts and workflows that most often lead to fraud or downstream access.

For payment and SaaS environments, the most useful signal is not simply whether a message was sent, but whether it is aligned to a monetisation path. If the lure is aimed at payroll, invoicing, payment administration, customer support, or executive webmail, the campaign is usually trying to reach accounts with unusual reach or authority. That makes identity protection, user verification, and monitoring around account recovery paths more important than blanket volume metrics.

Risk and Threat Considerations

Targeted phishing is dangerous because the attacker only needs a small number of successful handoffs to create material loss. In these sectors, the same stolen credential can expose payments, customer data, business email, or third-party access, so the blast radius is often larger than the initial lure suggests.

Failure mechanism: Attackers exploit trust in familiar brands and routine sign-in or payment workflows, then harvest credentials, tokens, or session access from users who expect those prompts to be legitimate.

Impact: Even with fewer campaigns overall, organisations can see higher-value account takeovers, fraud, lateral movement into SaaS estates, and repeated abuse of reset and consent flows.

Practitioner Guidance

What to prioritise: Focus first on the accounts and journeys that can produce the biggest downstream gain for an attacker, such as finance admins, support desks, executives, shared inboxes, and customer-facing login portals. Those are the places where a single compromise tends to create the most leverage.

What to verify: Check whether your detections distinguish broad phishing noise from sector-specific targeting, and whether brand abuse, fake login pages, and credential harvesting are being logged as separate patterns. That separation matters because a low-volume campaign can still be the one that reaches the highest-value users.

Decision rule: If a campaign is aimed at payment, financial, or webmail workflows, treat it as a trust and account-access problem first, not just an email-filtering problem. Increase scrutiny on sign-in anomalies, recovery channels, and any workflow that turns one compromised login into broader access.

Practitioner takeaway: Falling volume should change your forecast, not your urgency, because the real question is whether the remaining phishing is hitting the few accounts that matter most.

Related resources from NHI Mgmt Group

• Why do phishing and social engineering remain so effective against financial services firms?
• Why do phishing campaigns hosted on reputable SaaS services often bypass conventional detection?
• Why can a single SaaS app create such a large blast radius?
• Why do secrets stay dangerous even when they are no longer actively used?