Phishing: Today’s Big Security Problem, Tomorrow’s Big Marketing Problem

Phishing attacks are becoming more sophisticated and more common. Recent analysis reveals that an increasing amount of potentially fraudulent email is attributed to prominent global brands across a spectrum of industries. In addition to posing security risks and eroding consumer trust, email fraud may threaten targeted brands' ability to reach their customers. According to the latest figures from Return Path, roughly 9% of email appearing to come from leading brands during Q4-2014 and Q1-2015 was deemed suspicious, meaning the messages' true origin could not be authenticated. In all cases, the messages were sent from third-party IP addresses not known to have permission to send email on the brands' behalf. While this doesn't always indicate email fraud, suspicious messages are considered more likely to put recipients at risk. In this analysis, all of the brands included use the DMARC standard to see suspicious mail attributed to them. The standard also allows them to stop suspicious messages from reaching consumers. Of 235 billion messages evaluated during the six-month span, 21 billion were classified as suspicious and potentially fraudulent. And while the proportion of suspicious mail peaked at 13% during the holiday season, it remained elevated — near 10% throughout Q1-2015. That means that billions of messages that seem to come from international financial services providers, top-tier retailers, major airlines, and government agencies may in fact be sent by cyber criminals. Frequently the organizations whose names are used in attacks like these don't find out about them until customers alert them, often by flooding call centers. This adds another set of costs to the scramble to fix the damage done to customer relationships. Brands that use authentication-based solutions, including the DMARC standard, can detect these threats before they reach customers, but reducing the expense of clean-up may become a tangential benefit if mailbox providers treat DMARC adoption as a requirement for inbox placement. Earlier this year, Google product manager John Rae-Grant cautioned that Gmail is considering exactly that — scrutinizing large senders' efforts to protect consumers from email fraud as a condition of deliverability. "We're rapidly moving toward a world where all email is authenticated. Large inbox providers, like Google, track the reputation of all sending domains, and factor that in when deciding whether and how to deliver messages," he was quoted in a February DMARC.org press release. "Implementing a DMARC policy ensures that a sender's reputation doesn't drop due to the actions of spammers ... If your domain doesn't protect itself with DMARC, you will be increasingly likely to see your messages sent directly to a spam folder or even rejected." Brands like those included in the Return Path analysis are taking steps to protect consumers from fraud conducted under their names, but their efforts could also help them maintain email relationships with their customers as mailbox providers take DMARC adoption into account when making inbox placement decisions. Others could find it increasingly difficult to get their messages to subscribers, jeopardizing the performance of a critical marketing channel. Just like marketers, mailbox providers like Gmail depend on consumers' trust to survive and grow, so they have a direct interest in reducing phishing and the bad user experience it delivers. It would be no surprise if their stance on fraud prevention becomes, "If you don't take steps to protect our users, we'll do it for you." For email marketers, that's not a good option. Tom Sather is Return Path’s senior director of email research. Tom uses his knowledge of ISPs, spam filters and deliverability rules to advise marketers on how to get their email delivered to the inbox. He began his Return Path career as an email deliverability consultant working with top-brand clients like eBay, MySpace, IBM and Twitter. Tom’s previous experience includes roles with email service provider Experian and on the abuse desks for AOL, Bellsouth, AT&T and GTE.

General

Phishing: Today’s Big Security Problem, Tomorrow’s Big Marketing Problem

Tom Sather

About

Subscriptions

Events

Publications

WORK SMARTER - LEARN, GROW AND BE INSPIRED.

Subscribe today!

Tom Sather