Email security

Why your inbox is a bigger target than you think

Picture this. Tuesday morning, an email lands that looks exactly like your bank, logo and all, subject reading "your account has been suspended." Would you catch it in time? That's email security, or really, its absence. 

Email clients like Spark build in a lot of protection by default: spam filtering, sender warnings, that sort of thing. But no client can fully protect you if your password is "password123" and you've reused it on four other sites.

Verizon's 2024 Data Breach Investigations Report found that 68% of breaches involved a human element: someone clicking a bad link or falling for a social engineering pitch. That's most of them. The FBI's 2025 Internet Crime Report puts a dollar figure on it: business email compromise alone accounted for roughly $3 billion in reported losses in 2025, with the average complaint north of $122,000. Email fraud overall (BEC, phishing, and government-impersonation scams combined) topped $4 billion, about a fifth of all reported cybercrime losses that year.

Why does email keep working as an attack route? Faking a sender's address costs nothing, phishing kits sell on forums for less than a dinner out, and most people don't check where a link leads before tapping it. Increasingly, they can't check the usual way, either. More on that below. You don't need to be paranoid. You do need to know what you're defending against.

The threats and the defenses that stop them

You've got six threats worth knowing now, and they're not all equally dangerous.

Phishing is the fake-urgency email angling for your password, your card number, or a wire transfer. It's the most common threat by a wide margin, and it's changing shape: AI tools now write or assist a large share of the phishing emails circulating in the wild: one industry estimate puts it above 80% by early 2026, after a sharp jump in late 2025. That matters because the old advice to "watch for bad grammar and awkward phrasing" is aging out fast; AI-written lures read as cleanly as a real colleague's email. Spark's phishing email glossary entry breaks down current red flags in more depth.

Business email compromise (BEC) is phishing's more targeted, more expensive cousin. Instead of a mass blast, someone impersonates your CEO, a vendor, or a colleague, often with no link or attachment at all, just a convincingly worded request to change a bank account or rush a payment. It's why BEC accounts for a disproportionate share of email fraud losses relative to how many complaints it generates: low volume, high value. If a payment or bank-detail change request ever arrives by email alone, with urgency attached, that's the moment to confirm it through a second channel: a phone call to a known number, not a reply to the same thread.

Spoofing means someone fakes the email address in the "from" field, or registers a domain that looks close enough at a glance (paypa1.com, micros0ft-support.com), so a message looks like it's from your boss or your bank. It's a cheap trick that's disturbingly effective. It's exactly why domain owners lean on authentication protocols: SPF checks whether the sending server is authorized, DKIM adds a digital signature proving the message wasn't altered, and a DMARC record tells receiving servers what to do when something fails those checks. Stacked together, they're solid. Alone, each has gaps. You can find out more about how to avoid spoofing attacks in our guide.

Malicious attachments hide inside files disguised as invoices, resumes, or shipping labels. One click and you've installed something you didn't want. A good spam filter or secure email gateway catches most of these.

Quishing (QR-code phishing) is the newest entry on this list, and it's growing fast: some trackers recorded roughly a fivefold jump in QR-based phishing emails during 2025 alone. The trick is simple: the malicious link lives inside a scannable image instead of clickable text, so it slides past filters built to inspect URLs and past the "hover before you click" habit entirely, since you can't hover over a QR code with a mouse. Most quishing gets scanned on a phone, often outside whatever protection your email client or company network provides on a desktop. Treat any QR code inside an email, even one claiming to be a delivery notice or a "verify your account" prompt, with the same suspicion as a link, and check the URL preview your phone shows before you actually scan it.

Account takeover happens once your credentials leak elsewhere (an old breach, a reused password, a phishing page from months back) and someone else reads your mail and locks you out. This one does the most damage per incident, and it doesn't always require your password at all: attackers also steal active session tokens through malware or phishing pages, hijack OAuth permissions you granted to a third-party app, or exploit legacy "app password" logins that skip two-factor checks entirely. Once in, a common move is to quietly add a forwarding rule or inbox filter so they keep reading your mail even after you change your password. That's why checking for those is step one if you suspect you've been compromised (see below).

Gateways and filters screen incoming mail. Authentication protocols verify outgoing mail. Encryption protects what's inside a message in transit. Account-level protections guard the account itself. No single layer catches everything, but stacked together they catch most of it.

Encryption: the layer most guides skip

Authentication tells a receiving server the message really came from who it claims. Encryption is a separate question: can anyone reading the message in transit actually see what's inside it?

Most email today travels over TLS, an encrypted connection between mail servers, but TLS is typically opportunistic, meaning a server can fall back to sending a message unencrypted if the other end doesn't support it, without necessarily alerting anyone. That's solid baseline protection, not a guarantee.

For anything more sensitive, two older but still-relevant standards go further: S/MIME and PGP both encrypt the message content itself, end to end, so only the intended recipient can read it, regardless of what happens to it in transit or at rest on a server. Both require the sender and recipient to set up and exchange encryption keys or certificates in advance, which is exactly why they never went mainstream for everyday email: the setup cost is real. For most personal use, a reputable provider with solid TLS and strong account security covers the everyday threat model. For legal, medical, financial, or other genuinely sensitive correspondence, S/MIME, PGP, or a dedicated encrypted email service are worth the extra setup.

Securing your own inbox

Domain-level authentication is your email provider's job. Account security is yours. Worth five minutes of your afternoon? Absolutely. 

In Gmail: 

• Open your Google Account and select Security
• Under "How you sign in to Google," choose 2-Step Verification and turn it on
• Add a phone number or authenticator app when prompted
• Run a Security Checkup periodically to review devices and recent activity

In Outlook: 

• Sign in to account.microsoft.com/security and open the Security tab
• Select "Manage how I sign in," then find two-step verification under additional security
• Choose Turn On and follow the setup steps 

In Spark:

• Spark is an email client, not a mail host, so two-factor authentication and passwords live with Gmail, Outlook, or whichever provider you use.
• Use Gatekeeper to screen first-time senders and block unwanted contacts before they reach your inbox
• Keep the app updated so you're running current security fixes

Spark's really useful here, mostly because it doesn't ask you to relearn anything. Gatekeeper just quietly screens strangers in the background.

If you manage your own domain

If you send email as a business (support@yourcompany.com, invoices@yourcompany.com), SPF, DKIM, and DMARC aren't automatic. They're DNS records you, or whoever manages your domain, have to publish. A DMARC record looks something like this:

v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourcompany.com

That tells receiving servers: if a message claiming to be from this domain fails SPF or DKIM, quarantine it, send it to spam rather than deliver it, and email a report to this address so you can see who's trying to spoof you. Free tools like MXToolbox or Google's Admin Toolbox let you check whether your domain already has these records set up correctly. Worth doing once, then checking again after any change to your mail provider.

If you think you've already been compromised

Move fast, in this order: 

• Change your password immediately, from a device you trust, not the one you suspect is compromised.
• Revoke active sessions and app access. Most providers have a page listing every device and third-party app currently signed in; kick out anything you don't recognize.
• Check for forwarding rules and filters you didn't set up. Attackers often add a quiet rule that forwards your mail elsewhere or auto-deletes security alerts. This is the step people skip, and the reason takeovers persist after a password change.
• Turn on two-factor authentication if it wasn't already on.
• Warn contacts if the account was used to send anything. BEC and account-takeover attacks frequently spread by emailing everyone in the compromised person's contact list.

Email security for a small team

Everything above protects one person's inbox. Add even two or three people and the risk multiplies, since it only takes one compromised account or one convincing fake invoice to expose the whole group. A few extra habits cover most of that gap, no dedicated security staff required: 

• Put the "confirm payment or bank-detail changes by phone, not email" rule in writing, and actually tell your team about it once. Most BEC losses happen because nobody had this conversation before the fake invoice showed up.
• Turn on two-factor authentication for every account on the team, not just your own, and make it a standard part of onboarding whenever someone new joins.
• If you're already on Google Workspace or Microsoft 365, the phishing and malware filtering is built in and gets stronger as you layer on the account-security steps above. Most small teams don't need a separate security product on top of that.
• Do a quick access review every few months: old employee or contractor accounts that should've been removed, third-party apps nobody remembers connecting, forwarding rules that don't belong. It's the same check as the "if you've been compromised" list above, just done proactively instead of after something's gone wrong.

Tips for keeping your inbox safe

1. Turn on two-factor authentication everywhere you can. It's the single biggest lever you have, full stop.
2. Use a password manager. Reusing "Fluffy2015" across a dozen accounts is a liability, not a strategy.
3. Hover before you click, and treat anything that arrives as a QR code instead of a link with the same suspicion. You can't hover over an image.
4. Skip attachments from senders you don't recognize, especially ones marked "urgent."
5. Don't rely on writing quality to spot a fake anymore. AI-assisted phishing reads as cleanly as a real message now; the tell is more often in the request itself (urgency, a changed payment detail, pressure to bypass a normal process) than in typos.
6. Check your spam folder now and then, but don't rescue everything blindly. Some of it belongs there.
7. Keep your software current. Outdated systems are what attackers go looking for.

Frequently asked questions

Is my email provider's spam filter enough on its own? It catches the bulk of malicious mail, but no filter is complete: the human element still shows up in most breaches. Filtering, authentication, encryption, and account security work as a stack; none of them alone is sufficient.

What's the actual difference between phishing and spoofing? Phishing is the goal: tricking you into handing over information or money. Spoofing is one common technique used to do it: faking the sender so the message looks trustworthy. A phishing email is very often also a spoofed one, but you can have either without the other.

Does two-factor authentication fully stop account takeover? It stops most of it, particularly password-based attacks like credential stuffing. It doesn't stop everything: session-token theft and malicious OAuth app permissions can bypass 2FA because they don't need your password or a fresh login at all. It's still the single most effective step available, just not a total guarantee. 

Why can't I just "hover before I click" anymore? That advice assumes the malicious link is text you can see and inspect. QR-code phishing and some AI-generated attacks hide the destination inside an image or behind a redirect chain, so there's no link to hover over. Give unexpected QR codes and shortened links the same caution you'd give a suspicious link, just via a different check.

Related content

• Essential features a good email app must have

Related terms

• DKIM
• DMARC record
• Phishing email
• Spam filter