Three billion phishing emails are sent every day. But one change could make life much harder for scammers

Cyber criminals are sending over three billion emails a day as part of phishing attacks designed to look like they come from trusted senders.

By spoofing the sender identity used in the 'from' field in messages, cyber criminals attempt to lure potential victims into opening emails from names they trust. This could be the name of a trusted brand like a retailer or delivery company, or even, in more sophisticated attacks, the name of their CEO or a colleague.

These phishing attacks might sound simple, but they work – and that's why so many of these messages are distributed by cyber criminals. And according to a report by email security company Valimail, over three billion spoofing messages are sent every day, accounting for 1% of all email traffic.

SEE:  A winning strategy for cybersecurity (ZDNet special report) | Download the report as a PDF (TechRepublic) 

One of the reasons why email remains such a common attack vector is because of the rise of remote working. Employees are dealing with an increase in corporate communications being conducted over email, while the reality of working from home means that it's harder for people to ask if an email is legitimate.

All of this combined means that phishing emails are putting people and organisations at risk of cyberattacks, including credential theft, malware and ransomware.

However, it's possible for organisations to help defend against spoofed emails by applying DMARC (Domain-based Message Authentication, Reporting & Conformance), which is an email authentication protocol that, when implemented, means only authorized senders can send email using the domain, preventing spam emails being sent. It also contains a reporting function for ongoing improvement and protection.

DMARC enforcement helps prevent spoofed emails from being delivered in the first place, with analysis by Valimail finding that 1.9% of email from domains without DMARC enforcement is suspicious, while just 0.4% of email from domains with DMARC enforcement is suspicious.

SEE: Cybercrime groups are selling their hacking skills. Some countries are buying

Ultimately, domains without DMARC applied are almost five times more likely to be the target of phishing emails than domains that do have it applied, so organisations can help make the internet a safer place by protecting domains with it.

"Privacy laws already exist in Europe and parts of the United States, and if a company does any business in those areas, a DMARC policy at enforcement is essential," said Alexander García-Tobar, CEO and co-founder of Valimail.

"By having valid email authentication in place, companies protect themselves and their customers from privacy violations. Without it, emails are sent without permission, fines are issued, confidential information is obtained and reputations sink."

MORE ON CYBERSECURITY

• Ransomware vs WFH: How remote working is making cyberattacks easier to pull off
• 5 ways to lock down your Microsoft 365 account and keep hackers out 
  
• Cybersecurity teams are struggling with burnout, but the attacks keep coming
• Phishing emails: More than 25% of American workers fall for them 
  
• Ransomware: How clicking on one email left a whole business in big trouble