Email phishing signals: what the evidence says

For a mail reader that judges one open email offline with very few false positives. Numbers are the published ones; where a primary paper is paywalled the figure comes from the secondary source named.

1. Content and structure features, with prevalence

Fette, Sadeh and Tomasic (2007), PILFER, on about 860 Nazario phishing mails vs about 6,950 SpamAssassin ham, random forest, 10 fold CV: 0.22% false positives, 8.5% false negatives alone; 0.13% / 3.6% with SpamAssassin as an extra feature. Per feature prevalence, phishing vs ham:

Al-Momani et al. (2020, PhishOut), reusing Toolan and Carthy's (2010) features on Nazario phishing2 vs SpamAssassin easy_ham, information gain: NoLinks 0.849, capRatio 0.392, NoLinksIP 0.290, NoWords 0.281, NoLinkMismatch 0.274, NoPhishyWords (money, bank, update, verify) 0.067, @ in URL 0.058. Best model 99.76% precision, 0.119% FPR.

Saka, Vaniea and Kökciyan (2024), 503 Nazario mails 2015 to 2021: generic salutation 31.4%, the reader's own email address as salutation 21.7%, no salutation 34.0%, real name 12.9%. Threat 44.3%, urgency 35.2% (80% of urgent mails also threaten). Action is a click 86.1%, a download 13.3%. Most frequent action words: account 142, update 90, email 59, verify 46, view 46, upgrade 39, confirm 36. Top topics: password expiring, pending incoming emails, files via WeTransfer, monthly e-statements, mailbox almost full. Impersonated: the reader's own mail provider 45.1%, financial 30.0%.

Verma, Shashidhar and Hossain (2012): a sentence is suspicious when an actionable verb (click, update, verify, confirm, login) is user directed and carries urgency or a deadline. Bergholz et al. (2010): hidden salting (display:none, zero font, text the colour of the background) is a phishing marker.

2. What Microsoft and Google weight

Microsoft Defender for Office 365: user impersonation (a known display name on a different address), domain impersonation (lookalike registered domains that pass SPF/DKIM/DMARC), unusual characters in the address, first contact, unauthenticated sender; mailbox intelligence suppresses impersonation verdicts where there is prior history, which is their false positive control. Gmail: lookalike domain spoofing, employee name spoofing from a non company address, unauthenticated mail, encrypted attachments, attachments with scripts, anomalous attachment types, links behind shorteners, and "if the URL of the link doesn't match the description of the link".

3. Theme scripts 2023 to 2025

KnowBe4 Q4 2025 top clicked: document shared with you, IT assigned training, HR emergency contact, HR training past due, Teams manager trying to reach you, HR dress code, reimbursements; 89.6% of top clicked links involved domain spoofing. Cofense 2024: finance 54% of credential phish, notifications (password expiry, required actions) 35%. Egress 2024: DocuSign the most impersonated brand, Microsoft second; QR phishing 10.8%. Talos 2025 callback brands: Microsoft, NortonLifeLock, PayPal, DocuSign, Geek Squad, often a blank body with a PDF.

Phrase families (also seen in Nazario 2024): account suspend/restrict/deactivate; verify/confirm/validate/reactivate your account/identity/email; password expires today or in N hours, keep same password, mailbox or storage almost full, pending incoming messages; shared or sent a document with you, review and sign, signature required, complete with DocuSign, files via WeTransfer; new voicemail or voice message, missed call, listen or view transcript; invoice, remittance advice, purchase order, statement of account, outstanding balance with "attached" or "payment"; payroll, direct deposit, salary upgrade, open enrollment; package could not be delivered, on hold, reschedule, import duty or customs fee; unusual sign in attempt; subscription renewed or charged with an amount and a phone number and no links; gift card purchase and codes; scan the QR code.

4. Business email compromise

FBI IC3 2024: 21,442 BEC complaints, $2.77B. Fortra/APWG Q2 2025 cash out: gift cards 72%, payroll diversion 11%, wire 6%. Agari 2020: free webmail in 72% of BEC, lookalike domains 40%. Markers: "are you available / at your desk", "quick task", "reply when you get this", "tied up in a meeting", "keep this between us", "our bank details have changed", "update my direct deposit before payroll", an executive's name on gmail/outlook/gmx, a sender domain one edit from the real one.

5. The Nazario corpus

Hand screened from one inbox, 2003 to 2025, CC BY 4.0. 2003 to 2007 is PayPal and eBay, then Chase, Washington Mutual, Regions, Fifth Third, Amazon, Bank of America, Barclays, HSBC, Citi, Capital One, SunTrust. 2007 to 2011 adds USAA, generic webmail, IRS. 2015 onward: USAA, Apple, DHL, ABSA, Nedbank, Standard Bank, DocuSign, WeTransfer, OneDrive, Google, cPanel, UPS, Netflix, MetaMask. A brand list needs both the bank era and the document era.

References

Al-Momani, S. et al. (2020). PhishOut: Effective phishing detection using selected features. arXiv:2004.09789. Bergholz, A., De Beer, J., Glahn, S., Moens, M.-F., Paass, G., & Strobel, S. (2010). New filtering approaches for phishing email. Journal of Computer Security, 18(1), 7-35. Cofense. (2024). 2024 annual report. Cofense. (2026). When routine becomes the threat: Finance-themed phishing. Egress. (2024). Phishing threat trends report. FBI IC3. (2025). 2024 Internet crime report. https://www.ic3.gov/AnnualReport/Reports/2024_IC3Report.pdf Fette, I., Sadeh, N., & Tomasic, A. (2007). Learning to detect phishing emails. WWW 2007, 649-656. Google. (2026). Advanced phishing and malware protection; Avoid and report phishing emails. https://support.google.com/mail/answer/8253 KnowBe4. (2026). Q4 2025 phishing report. https://www.knowbe4.com/hubfs/Q4-2025_Phishing-Report-Infographic_EN.pdf Malwarebytes. (2025). Microsoft, PayPal, DocuSign, and Geek Squad faked in callback phishing scams. Microsoft. (2025). Anti-phishing protection in Microsoft Defender for Office 365. https://learn.microsoft.com/en-us/defender-office-365/anti-phishing-protection-about Nazario, J. (2005-2026). Phishing corpus. https://monkey.org/about jose/phishing/ Saka, T., Vaniea, K., & Kökciyan, N. (2024). Phishing codebook. arXiv:2408.08967. Toolan, F., & Carthy, J. (2010). Feature selection for spam and phishing detection. eCrime Researchers Summit 2010. Verma, R., Shashidhar, N., & Hossain, N. (2012). Detecting phishing emails the natural language way. ESORICS 2012, LNCS 7459, 824-841.