Email identity theft in 2026: the risk businesses can no longer ignore

In 2026, email has become a paradoxical channel. More used than ever by trusted organisations, yet technically the most vulnerable. While instant messaging apps add signatures, end-to-end encryption and authenticity indicators, email remains a protocol designed in 1982 for researchers who trusted each other.

This long-tolerated technical debt is now exploding. Three converging factors are changing the very nature of the risk.

1. Mailbox takeover has become routine

CERT-FR publishes dedicated response sheets for the compromise of professional messaging accounts – a sign that this type of incident, once marginal, is now frequent enough to justify a standardised procedure. Attackers no longer need to breach a server: a password reused between a compromised consumer service and the corporate mailbox is enough.

Once inside, the attacker often does nothing visible for several weeks. They read. They observe ongoing files, signature habits, recurring suppliers, typical amounts. Then they act, from the real address, in a real conversation, with the right tone.

At this stage, no spam filter, no DMARC rule, no staff awareness training triggers an alert. Everything is technically legitimate.

2. Mass leaks have put context on the shelf

Fifteen years of public leaks, from LinkedIn dumps to combo password lists, have made a target's personal context available in a few clicks: exact role, hierarchy, usual partners, sometimes past exchanges. Personalised phishing is no longer the preserve of state actors. It has become the standard.

An attacker can write to an accountant citing the CFO's name, the audit firm, the current closing month, and sign as a real supplier with an altered IBAN. None of it is invented: it all comes from a five-minute search.

3. Generative AI has erased the weak signals

For a long time, human defences relied on three tells: spelling mistakes, odd phrasing, a poorly copied signature. Language models made them disappear within eighteen months. A fraudulent email written in 2026 is, in terms of wording, indistinguishable from a genuine one.

What trusted organisations must now prove

In this environment, an organisation that communicates by email, notary, school, firm, insurer, public body, can no longer settle for a signature at the bottom of the page. For every message, it must be able to demonstrate three things:

• Sender identity: this message really comes from this person, in this organisation.
• Content integrity: nothing changed between sending and reading.
• Verifiability by the recipient: the recipient must be able to check it without being an expert.

SPF, DKIM and DMARC partially address the first point at domain level. No widely deployed standard covers the other two end-to-end, readable inside the mail client.

The regulatory turning point

The eIDAS 2.0 regulation, adopted in 2024 and ramping up in 2026, explicitly raises the question of verifiable digital identity for legal entities. The EU Digital Identity Wallet (EUDI Wallet) rolls out its first wave in 2026 and 2027. Regulated professions will be among the first affected.

This creates an opportunity: aligning email communication with the same level of proof required for a qualified electronic signature. Technically, it's possible today. Politically, it has become necessary.

Conclusion

The risk has changed shape. It's no longer a poorly written email asking for a wire transfer to a "Nigerian prince". It's a perfect message, from a real address or its lookalike, in the right conversation, at the right moment, exploiting your brand to trap your own people.

The answer can no longer be to ask recipients to be more vigilant. It must be to give them a binary, reliable signal: this message carries the cryptographic signature of the organisation it claims to represent, or it doesn't. Everything else is guesswork.