Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Comprehensive List of User Deception Techniques in Emails

Maxime Veit, Mattia Mossano, Tobias Länge, Melanie Volkamer

Abstract

Email remains a central communication medium, yet its long-standing design and interface conventions continue to enable deceptive attacks. This research note presents a structured list of 42 email-based deception techniques, documented with 64 concrete example implementations, organized around the sender, link, and attachment security indicators as well as techniques targeting the email rendering environment. Building on a prior systematic literature review, we consolidate previously reported techniques with newly developed example implementations and introduce novel deception techniques identified through our own examination. Rather than assessing effectiveness or real-world severity, each entry explains the underlying mechanism in isolation, separating the high-level deception goal from its concrete technical implementation. The documented techniques serve as modular building blocks and a structured reference for future work on countermeasures across infrastructure, email client design, and security awareness, supporting researchers as well as developers, operators, and designers working in these areas.

Comprehensive List of User Deception Techniques in Emails

Abstract

Email remains a central communication medium, yet its long-standing design and interface conventions continue to enable deceptive attacks. This research note presents a structured list of 42 email-based deception techniques, documented with 64 concrete example implementations, organized around the sender, link, and attachment security indicators as well as techniques targeting the email rendering environment. Building on a prior systematic literature review, we consolidate previously reported techniques with newly developed example implementations and introduce novel deception techniques identified through our own examination. Rather than assessing effectiveness or real-world severity, each entry explains the underlying mechanism in isolation, separating the high-level deception goal from its concrete technical implementation. The documented techniques serve as modular building blocks and a structured reference for future work on countermeasures across infrastructure, email client design, and security awareness, supporting researchers as well as developers, operators, and designers working in these areas.

Paper Structure

This paper contains 87 sections, 67 figures.

Table of Contents

  1. Introduction
  2. Fundamentals
  3. Sender Security Indicator
  4. Link Security Indicator
  5. Attachment Security Indicator
  6. Structure of the report
  7. Sender-related Deception Techniques
  8. Sender Email Address Spoofing
  9. Sender Email Address Local-Part Replacement
  10. Sender Name Replacement
  11. Implementation: Different Sender Name
  12. Implementation: Email Address in the Sender Name
  13. Implementation: Look-alike Email Address in the Sender Name
  14. Sender Spoofing using Notification Services
  15. Sender Exceedingly Long
  16. ...and 72 more sections

Figures (67)

  • Figure 1: Sender Security Indicator structure and terminology for different components.
  • Figure 2: URL structure and nomenclature of its components. (eTLD: Effective Top-Level-Domain)
  • Figure 3: Base scenario - phishing email detectable after security awareness training.
  • Figure 4: Example of Sender Email Address Spoofing.
  • Figure 5: Example of Sender Email Address Local-Part Replacement.
  • ...and 62 more figures