Email scam types are the main ways attackers use email to trick people into sending money, revealing secrets, or clicking malicious links. Common forms include phishing, spear phishing, impersonation, invoice fraud, account takeover, and malware delivery. These scams exploit trust, urgency, and weak identity controls across human and non-human accounts.
What email scam types are trying to achieve
Email scam types are not just different messages with the same intent, they are different delivery patterns for the same abuse goals. Attackers use them to create urgency, impersonate trusted people or brands, and move the victim toward payment, credential entry, or a malicious click.
The practical distinction matters because each scam type changes the attacker’s path. A phishing email usually seeks broad credential capture, while spear phishing narrows the target and message. Impersonation and invoice fraud lean on business process trust, account takeover turns a stolen mailbox into a distribution point, and malware delivery uses email as the first stage of compromise.
Common email scam categories
Phishing is the broad, high-volume form. It typically uses generic lures, fake login pages, or urgent notices to harvest secrets or session access.
Spear phishing is more tailored. The message may reference a real project, vendor, colleague, or role to make the request look normal enough to bypass careful review.
Impersonation and business email compromise rely on trust relationships. The attacker pretends to be an executive, supplier, payroll contact, or internal support function and asks the recipient to change payment details, approve a transfer, or share information.
Invoice fraud is a process-focused version of impersonation. The scam depends on people accepting what looks like a legitimate bill, remittance request, or banking update.
Account takeover changes the pattern again. Once an inbox is compromised, the attacker can reset passwords, intercept alerts, and send convincing follow-on messages from a real account.
Why these scams work
Email scams succeed because they exploit human judgment under time pressure. The message does not need to be technically sophisticated if it feels routine, urgent, or authoritative enough to trigger fast action.
They also exploit weak identity controls. Poor mailbox protection, reused passwords, weak verification steps, and over-trusted internal communications all make it easier for a scam to cross from a suspicious message into a real security event.
Some scams are purely social engineering, but others carry technical payloads. A malicious attachment or link may lead to credential theft, malware installation, or a fraudulent login flow that collects secrets and session data.
How organisations reduce exposure
Email scam risk drops when organisations treat email as an untrusted channel by default and verify sensitive requests through separate procedures. That includes validating payment changes, out-of-band confirmation for high-value requests, and stronger authentication for accounts that receive external mail.
Security teams also need to harden the email ecosystem itself. NIST SP 800-53 Rev 5 Security and Privacy Controls gives a useful control baseline for access control, authentication, audit logging, and system integrity, while NIST SP 800-63 Digital Identity Guidelines helps reduce account takeover risk with phishing-resistant authentication. NIST Cybersecurity Framework 2.0 is also useful for structuring prevention, detection, response, and recovery around email abuse.
For organisations that rely heavily on email-driven business processes, the most effective controls combine user awareness, mailbox protection, domain authentication, secure approval workflows, and monitoring for unusual forwarding, login, or payment behavior.
Risk and Threat Considerations
Email scam types create a direct path from deception to financial loss, credential theft, malware infection, and business process abuse. The risk is highest when the recipient can act on the request immediately, without a second verification step.
Failure mechanism: The attacker gains trust by copying language, timing, or sender context, then uses that trust to move the victim into revealing secrets, approving a payment, or opening a malicious payload. A compromised mailbox can then be reused to extend the scam inside the organisation.
Impact: The result can include fraudulent transfers, account takeover, lateral spread of malicious messages, loss of confidentiality, and post-compromise cleanup across mailboxes, identities, and downstream systems.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5, NIST SP 800-63 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | Email scams often target user credentials and mailbox access. |
| AU-6 — Audit Review, Analysis, and Reporting | Suspicious logins and forwarding changes are key email-scam detection signals. | |
| AC-6 — Least Privilege | Limiting mailbox and payment privileges reduces the blast radius of scam success. | |
| Recommendation — Enforce strong user authentication and reduce the chance of account takeover. Review mail and identity logs for anomalous access and suspicious message activity. Restrict permissions so a compromised account cannot trigger broad financial or mailbox abuse. | ||
| NIST SP 800-63 | Phishing-resistant authentication | The guideline directly addresses stronger authentication that helps prevent email-account takeover. |
| Recommendation — Adopt phishing-resistant authentication for accounts exposed to email-based credential theft. | ||
| NIST CSF 2.0 | PR.AA-05 — Authenticator Management | Email scams frequently depend on stolen or weak authenticators to compromise accounts. |
| Recommendation — Strengthen authenticator handling to reduce credential and session abuse in email attacks. | ||
| MITRE ATT&CK | T1566 — Phishing | Email scams commonly use phishing and related social engineering delivery techniques. |
| T1114 — Email Collection | Mailbox compromise can expose internal correspondence and enable follow-on abuse. | |
| Recommendation — Map observed email lures to phishing techniques and tune detections to the delivery pattern. Hunt for mailbox access and message harvesting after suspected email compromise. | ||
Practitioner Guidance
What to watch for: Treat urgency, payment redirection, unexpected attachments, and login prompts that arrive outside normal process as high-signal warning signs. The most dangerous scams often look ordinary rather than obviously malicious.
Governance implication: Organisations should own email scam resilience as a cross-functional control issue, not just a user-awareness issue. Finance, identity, security operations, and mailbox administrators all need clear approval rules and escalation paths for suspicious requests.
Practitioner takeaway: The best defence is layered verification, because no single filter or training programme reliably stops every email scam type.
Related resources from NHI Mgmt Group
- What are the signs that a supplier-based phishing campaign is more dangerous than a typical email scam?
- What are the signs that a gift card scam is being attempted through email?
- What happens when users respond to scam messages through SMS, email, or phone instead of verifying the request independently?
- How should organisations update email security controls during the holiday season to reduce charity and delivery scam risk?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 25, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org