STEGA TRUST
    Threat 01

    Phishing

    Email fraud made simple: how it works, how far it has evolved, and why filters are no longer enough.

    InboxWithout STEGA TRUST
    Dupont & Partners Firm
    Bank details change - action required

    Please update our bank details before 08/05/2026. Kind regards. Regards,  D&A Firm.

    VS
    InboxWith STEGA TRUST
    Dupont & Partners Firm
    contact@cabinet-dupont.fr
    STEGA TRUST-certified identity
    Bank details change - action required

    Please update our bank details before 08/05/2026. Kind regards. Regards,  D&A Firm.

    Sender authenticated
    Definition

    What are we talking about exactly ?

    Phishing refers to any attempt to obtain sensitive information, a payment or an action by posing as a trusted entity. Email remains the top channel, ahead of SMS and business messaging apps.

    By 2026, phishing is no longer amateur work. Generative AI produces flawlessly written, well-contextualised messages, sometimes personalised using leaked public data.

    Mechanism

    How it works

    1. 1
      Reconnaissance

      The attacker gathers public information: LinkedIn org charts, email signatures from leaks, press releases.

    2. 2
      Spoofing or look-alike domain

      They forge the sender's address, or register a near-identical domain (stegaa.com, stega-trust.com).

    3. 3
      Credible pretext

      An invoice to settle, updated bank details, a security check, an urgent request from a manager.

    4. 4
      Triggered action

      Clicking a link, downloading a file, making a transfer, sharing a password.

    Figures

    What the data tells us

    16 %
    of confirmed data breaches have phishing as the initial access vector (Verizon DBIR)
    +1 265 %
    increase in phishing since generative AI emerged (SlashNext)
    4,9 M$
    average cost of an email-based breach (IBM Cost of a Data Breach)
    Real cases

    Concrete examples

    Case
    Fake Microsoft support

    An email impersonating Microsoft demands a password check within 24h or the account is suspended. The landing page is a pixel-perfect copy of the portal.

    Case
    Fake supplier

    A message reuses a known supplier's signature and announces a change of IBAN for the next invoice.

    Defences

    What works, and what falls short

    • Standard spam filters: they block noise, not targeted attacks.
    • Awareness training alone: useful, but humans remain fallible against a well-written message.
    • Domain authentication standards (SPF, DKIM, DMARC): useful but limited to the technical envelope.
    • Cryptographic proof of sender identity, visually verifiable by the recipient. That's STEGA TRUST's role.
    STEGA TRUST's response

    How STEGA TRUST responds to this threat

    STEGA TRUST signs every outgoing email with a cryptographic key tied to the organisation's identity. The recipient sees a verified badge in their mail client and can check authenticity in one click on stegatrust.com/verifier.

    A fraudulent email imitating your brand won't have the badge. It becomes instantly detectable.

    Protect my organisation
    Quiz

    Test your knowledge

    1. What percentage of confirmed data breaches have phishing as the initial access vector?
    2. Is DMARC enough to prevent identity impersonation?
    3. Why does generative AI make phishing worse?
    Frequently asked questions

    The essential answers

    Classic signals (spelling mistakes, suspicious address, poorly reproduced logo) are increasingly unreliable: with generative AI, a fraudulent email is now written without errors and visually identical to the original. The only reliable way is to verify the message's origin technically rather than its appearance.
    Going further

    Keep reading

    Threats hub
    See the other threats
    Blog
    In-depth articles