Phishing: Recognition and Prevention | Securevalley

July 2, 2026 · Nouh Droussi · Cybersécurité · Maroc · 4 min read · Updated September 26, 2026

How to spot a phishing email and build a layered defence: SPF, DKIM, DMARC, filtering, FIDO2 MFA and an incident response procedure.

Phishing consists of impersonating a trusted party to push someone into clicking a link, opening an attachment, entering their credentials or approving a payment. In practice, it can be spotted through a few concrete warning signs, and it can be prevented by combining technical measures, phishing-resistant authentication and clear procedures for users. No single measure is enough: it is the layering of defences that reduces the risk.

The main forms of phishing

The underlying principle always stays the same, but the channels used and the targets chosen vary:

• mass email phishing, which imitates a bank, a delivery company or an online service;
• spear phishing, which targets a specific person or department and is prepared using public information (social networks, the company website);
• CEO fraud or business email compromise (BEC), where the attacker poses as an executive or a supplier to obtain a wire transfer;
• smishing (by SMS) and vishing (by phone), often used to complement an email or to obtain an authentication code;
• QR code phishing, which takes the victim outside the email protections by getting them to scan a code with their phone.

The end goal is often credential theft, which is then used to access email, the VPN or cloud applications, or the installation of malware that prepares a wider intrusion.

Recognising a suspicious message

Users therefore remain the last line of defence. A few simple checks, regularly reinforced, make it possible to detect a large share of attempts:

• an unusual or urgent request: a change of bank details, an unsolicited password reset, a threat of account suspension;
• a sender address or domain name that differs slightly from the expected one, sometimes by a single character;
• a link whose real destination (visible on hover) does not match the displayed text;
• an unexpected attachment, especially an archive, a document asking you to enable macros, or an HTML file;
• an offer that seems too good to be true, or a request for sensitive data by email or by phone.

The right reflex when in doubt is simple: do not reply to the message, and verify the request through another known channel (the usual phone number, the internal directory).

Technical email defences

Several technical layers filter messages before they reach the user:

• sender domain authentication with SPF, DKIM and DMARC. A DMARC policy set to "quarantine" or "reject" limits direct spoofing of your own domain;
• an email security gateway that analyses reputation, links and attachments, with sandbox analysis for suspicious files;
• link rewriting and time-of-click analysis, since a website can become malicious after the message has been received;
• web and DNS filtering at the firewall or endpoint level, which blocks access to known phishing sites even if the email got through.

In a Fortinet environment, these functions are covered in particular by FortiMail for email and by the FortiGate web and DNS filtering profiles.

Phishing-resistant authentication

Credential theft remains the most common objective. A password alone no longer offers protection, and some multi-factor authentication methods (SMS codes, one-time passcodes, push notifications approved out of habit) can be bypassed by a relay site that intercepts the session. In their joint phishing guidance, CISA, the NSA, the FBI and the MS-ISAC recommend prioritising phishing-resistant multi-factor authentication. Methods based on FIDO2/WebAuthn (security keys, passkeys) meet this need, because authentication is cryptographically bound to the legitimate domain and does not work on a fake site.

Preparing the incident response

Even when well protected, an organisation will receive malicious messages that get past the filters. It must therefore plan what happens next:

• a button or dedicated address so that users can easily report a suspicious message;
• a procedure to search for and remove identical messages from mailboxes;
• if credentials were entered: password reset, revocation of active sessions, and review of forwarding rules created in the mailbox;
• retention of the original message and the logs for analysis;
• simulation exercises, followed by educational feedback rather than sanctions.

Skills and training

Fighting phishing involves several roles: administrators, SOC analysts and incident handlers. Preparation for CompTIA Security+ lays the foundations of social engineering threats and the related controls. To handle incidents end to end, EC-Council ECIH details the handling of email-related incidents, and Certified SOC Analyst (CSA) prepares for alert detection and triage in a security operations centre.

Conclusion

Phishing exploits trust more than technology. To counter it, combine domain authentication, email and web filtering, phishing-resistant multi-factor authentication, and users trained to report rather than stay silent. A well-rehearsed response procedure then limits the impact of the messages that slip through the net.