Phishing poses a serious threat to both individuals and companies.

The phishing statistics give an idea of the prevalence and severity of phishing attacks, which are mainly carried through email phishing as primary vector (96%¹ according to “IBM's 2021 Cost of a Data Breach Report.

The objective of a phishing attack is to steal credentials to victims or steal personal information, thus the hacker can perform any type of fraud.

Whilst phishing can take many forms and the bad actor can request various types of information to the target, all emails and communication share some characteristic.

You have probably noticed that, all the phishing mails are poorly written and some details may let us think they are somewhat unprofessional.

Accuracy and well-written emails share insights about the sender characteristic.

Would you ever reply to a marketing mail if it contains mistakes?

Probably not because, if the company would present the product with missing components or broken parts you would consider this as a poor-quality brand and eventually not buying from them.

This does not happen with phishing emails, which share this low accuracy and sophistication.

Whilst legitimate mail communications present a clear and neat structure, most frauds are characterized by the presence of words with grammar errors and misspellings.

What is the reason?

Although English as a language is simple and represents the most spoken language in the world, only 20% of the population is a native speaker.

This results in a nightmare for non-native people who have to learn and master this language in both spoken and written communication.

Nevertheless, only few proficient people can detect spelling errors, thus the rest is more prone to overlook such imprecisions because they are naïve.

Therefore, the question is why do they choose to write so badly if such communications only raise the attention of the most gullible people?

It is somehow a limitation to the effectiveness of the phishing campaign itself and bad actor should improve the quality of such mails.

This is intentional, because writing perfect emails can be counterproductive too.

Some bad actors deliberately use poor grammars and typos in order to get the attention of the victims.

Not all hackers use poor quality mails but they are aware that spam filters may detect scams.

Indeed, every mail provider implements an algorithm which is capable of detecting phishing emails and iteratively learn and detect such patterns.

If you receive so many emails from a specific sender or with a similar content, that mail would be put in the spam folder automatically by your email client.

Some email filters specifically look for exact matches of keywords which are relevant for scammers.

Therefore, if some words are misspelled they would not be detected by spam filters, thus reaching the inbox of the victims.

Email typos have also another great use case, which relates to human psychology.

Nowadays, gaining the attention of any type of audience is becoming more and more complicated, especially of the youngest people.

If an email contains misspelled word, it is easier for the victim to raise the attention and check the content.

Going through the content to check mistakes increase the chances of this mail being read.

How does a poor quality scam email looks like?

Here's some examples

The information contained in this article is provided by White Blue Ocean, part of CRIF Group, a global company specializing in credit & business information systems, analytics, outsourcing and processing services, as well as advanced digital solutions for business development and open banking.

Reference List

https://www.egress.com/resources/cybersecurity-information/phishing/2021-phishing-statistics 

https://medium.com/purple-theory/why-are-scam-emails-so-poorly-written-6fd186811401

https://umbrella.cisco.com/blog/grammar-and-spelling-errors-in-phishing-and-malware

https://www.ibm.com/downloads/cas/OJDVQGRY

https://www.proofpoint.com/it/threat-reference/phishing

The information contained in this article is provided for informational purposes only and does not constitute professional advice and is not guaranteed to be accurate, complete, reliable, current or error-free.