Reviews
Part of How to decide what a phishing message actually wants from you
A framework for judging phishing defenses
For phishing scams, this framework shows where seven defenses sit, which two block rather than warn, and six questions to ask before relying on a product.
For phishing scams, anti-phishing tools sit at seven different points between a message being sent and you doing something you regret. Knowing which point a tool occupies tells you what it can possibly do, before you look at a single feature list.
Two of the seven change outcomes. The rest reduce volume and buy attention, which is worth having and is not the same thing.
What to take away
- A tool that blocks an action beats one that shows a warning. Warnings get clicked through.
- Filtering reduces how much arrives. It cannot be the plan, because the message that matters is the one that gets through.
- Anything sold to you off the back of a scare, especially after an incident, deserves more suspicion than the scare did.
The seven points, and what each can do
What it does
- Mail and message filtering
- Removes most of the volume before you see it
- The browser
- Warns on known bad pages
- DNS or network layer
- Blocks resolution of known bad domains
- The password manager
- Refuses to fill on the wrong domain
- The authentication method
- Makes a copied page unusable
- The device and its updates
- Closes the technical routes
- The report button
- Turns one person's near miss into everyone's filter rule
What it cannot do
- Mail and message filtering
- Catch the targeted message written for you
- The browser
- Recognize a page registered this morning
- DNS or network layer
- Help on a device that is not on that network
- The password manager
- Stop you copying the password across manually
- The authentication method
- Help with payments, installs, or persuasion
- The device and its updates
- Do anything about what you type voluntarily
- The report button
- Work if nobody uses it
Rows four and five are the ones that block rather than warn. If you only do two things, do those.
Seven points, block or warn
Where it sits
- Mail filtering
- Removes volume
- Browser
- Warns on known bad
- DNS layer
- Blocks bad domains
- Password manager
- Blocks wrong domain
- Authentication
- Blocks copied page
- Device updates
- Closes routes
- Report button
- Improves filters
What it does
- Mail filtering
- Misses targeted message
- Browser
- Misses new domains
- DNS layer
- Fails off-network
- Password manager
- No manual copy stop
- Authentication
- No payment help
- Device updates
- No voluntary typing
- Report button
- Needs users
What it cannot do
- Mail filtering
- Browser
- DNS layer
- Password manager
- Authentication
- Device updates
- Report button
The two that actually block
Domain matching in a password manager. It fills based on the address, so on a copied page it offers nothing. That silence is a better detector than your judgment, and it works when you are tired, which is when this matters. The rule to attach to it: when it does not fill, stop. Do not go into the vault and copy the password across to make the page work.
Two blocking defenses
- Password managerno fill on copied page
- When it does not fill, stop
- Do not copy password manually
- Add security key or passkey
- Put on email first, then money
- Register backup method
A phishing-resistant factor. A security key or a passkey is tied to the real site, so a copied page cannot use it at all. Codes cannot do this, whatever produces them, because a code is something a human reads and can therefore type in the wrong place. Put one on your email account first, then anything holding money, and register a backup method so a lost device is not a lockout. The plain explanation of why the factor type matters is in NIST's introduction to multi-factor authentication.
The rest of the account-side tooling, and how to choose within each category, is in account security tools.
Filtering, honestly
Filtering is genuinely valuable and it is not a defense you can rely on, for one structural reason: it works on volume, and the message that reaches you is the one that got through the filter. Its worth is in reducing how many decisions you have to make per day, which raises the quality of the ones you do make.
Two consequences. Do not treat "it was in my inbox" as a verdict, because a filter passing something is not an endorsement. And use the report action rather than deleting, since reporting improves the filter and deleting does not.
Evaluating anything in this area
Six questions that separate a useful product from a subscription.
Six questions for any tool
- Does it block or warn?
- Does it fail closed or open?
- How noisy is it?
- What access does it need?
- Does it work everywhere you are?
- What happens when it is wrong?
- Does it block or does it warn?A warning you can click past becomes a habit within a month.
- Does it fail closed or open?A protection that silently stops working is worse than one that visibly blocks you, because you keep behaving as if it is there.
- How noisy is it?A tool with frequent false alarms trains people to dismiss real ones. That is a security cost, not an annoyance.
- What access does it need?Something requiring broad access to your mail or your accounts has enlarged the target. Ask what happens to that access if the company is sold.
- Does it work everywhere you are?A control tied to one network or one device leaves the phone, which is where a lot of this arrives.
- What happens when it is wrong?There must be a way for a person to say "this was legitimate" and get on with their day.
For a team, in order of value
If you are spending a budget rather than an afternoon, the order is fairly stable.
Team spending order
- Phishing-resistant factor on admin and finance
- Managed password manager
- Email authentication for your domain
- Filtering and monitored report button
- Training for reporting behavior
Start with a phishing-resistant factor on administrative and finance accounts; it changes what is possible, not what is likely. Then add a managed password manager, for domain matching as much as for passwords. Then set up email authentication for your own domain, so impersonating you to your customers is harder.
Then add filtering, which your mail service likely already includes, and a reporting button that goes somewhere a person monitors.
Training belongs in that list too and it is not a tool. What it buys is the reporting behavior in the phishing scams policy template, which is worth more than recognition skills that expire.
Tools that are not software
Worth naming, because they cost nothing and cover the situations software cannot see.
Call a number you already held. Agree on a question a family or a team can answer but an outsider cannot. Rule that payment details never change because of a message, and add a second approver above an agreed amount.
These handle the whole category of attacks that never touch a login page, which are most of the expensive ones.
The category to avoid
There is a persistent business in selling protection to people who have just been frightened, and a worse one in selling recovery to people who have just lost something. Both arrive unprompted, both reference your specific situation, and both ask for payment before anything happens.
No legitimate service charges an upfront fee to recover an account or funds. Official routes are listed at USAGov's page on where to report a scam.
If you lost something, the routes are your provider's own recovery process, your bank, and the fraud reporting body where you live. They are described in phishing scams, and none cold-call you.
Common questions
Is a paid email security product worth it for a small team?
Usually less than a phishing-resistant factor on your finance and admin accounts, which costs far less and blocks rather than warns. Spend there first.
Do browser warnings help?
They catch known bad pages, and a page set up this morning is not known yet. Treat them as a useful backstop, not as coverage.
Should I install a security extension?
Be careful. An extension that can read every page you visit is a large amount of access to grant, and browser extensions change ownership. Prefer protections built into software you already trust.
What single change helps most on a phone?
Doing banking and shopping through apps rather than links, and keeping the phone updated. There is no address to misread in an app, and setup is easiest during the move described in the new phone privacy checklist.
How do I know a tool is doing anything?
Watch what it blocks over a month, and check that its failure would be visible to you. A tool whose absence you could not detect is not part of your defense.
