What is Phishing?

Phishing refers to an attack that uses email to tricks or fools people into taking an action, such as clicking on a link or opening an attachment. By falling victim to such an attack, you risk having your highly sensitive information stolen and/or your computer infected. Attackers work hard to make their phishing emails convincing. For example, they will make their email look like it came from someone or about something you know, such as a friend or a trusted company you frequently use. They will even add logos of your bank or forge the email address so the message appears more legitimate. Then the attackers send these phishing emails to millions of people. They do not know who will fall and therefore all they know is the more emails they send, the greater the chance for success. Phishing is similar to using a net to catch fish; you do not know what you will catch, but the bigger the net, the more fish you will find.

The primary cause of a Phishing warning?

The primary cause from testing shows if the FROM domain is different to the Return-Path domain then this will result in a phishing warning. This is because emails are actually sent from the Return-Path domain and not the FROM domain which recipients see. Therefore, having a different FROM domain makes it look like it came from that domain which is misleading and looks like the sender is trying to phish the user.

Here is an example of the phishing warning within a Microsoft email client

"This sender failed our fraud detection checks and may not be who they appear to be."

How can you prevent Vuture emails from being marked as Phishing

Tests have shown by having a Custom Return-Path domain that matches the FROM domain (everything after the @ symbol)- this stops the phishing warning from being displayed. This is because the domain in the FROM and Return-Path are aligned and match. This means the domain the recipients see is where the message has come from and it is not seen as phishing.

1. Have your instance setup with a Custom Return-Path domain that matches your FROM domain
2. Only use FROM addresses that include a domain that matches the Return-Path domain whether this be the Return-Path domain itself, another sub-domain or the company domain

For example:

FROM address could be marketing@mycompanydomain.com where the domain is @mycompanydomain.com

Return-Path domain could be @emarketing.mycompanydomain.com

The Return-Path domain is a sub-domain of the @mycompanydomain.com domain and therefore there is alignment as they are related.

Please see the Custom Return-Path Implementation article

Additional Notes

1. Please note. the Custom Return-Path implementation is a premium feature so please contact your account manager for further details.
2. Tests were conducted internally using the Microsoft Outlook 2016 email client along with an internal Vuture instance.