Detection Accuracy
Honest information on how each detection engine performs and what SpoofShield cannot catch.
Security vendors should be transparent about limitations, not only headline claims.
Last updated: 2026-09-20
How to read these numbers
Detection rates are indicative figures based on internal testing against labelled email datasets and known BEC and phishing samples. Real-world performance varies with configuration quality, message characteristics, email platform, enabled engines, and attacker sophistication. No detection system guarantees 100% coverage.
Detection engines
Behavioural Analysis
Tone, urgency, and manipulation-pattern detection
Analyses urgency cues, authority claims, secrecy requests, and other manipulation patterns associated with BEC and phishing. Performance varies with email length, language, and how clearly the behaviour is expressed.
Known limitations
- English-language patterns currently have the broadest coverage.
- Very short messages may not contain enough context for a confident result.
- Novel social-engineering styles may evade known patterns.
Typosquat Domain Detection
Look-alike, homoglyph, and domain-variation matching
Compares sender domains with trusted and known domains using edit distance, homoglyph substitutions, and domain-variation heuristics. It is most effective against domains designed to resemble a known organisation.
Known limitations
- Detection depends on the quality of trusted-domain and known-sender context.
- An unrelated attacker-controlled domain may not resemble a trusted domain.
- Legitimate organisations with similar names may require administrator review.
VIP Impersonation Detection
Executive name and sender-domain mismatch alerts
Cross-references sender identity with configured VIP contacts and expected domains. A high-risk alert is generated when a protected identity appears from an unexpected address or domain.
Known limitations
- Effectiveness depends on keeping the VIP list current.
- An attacker using an unrelated name may not trigger this engine.
- Legitimate personal addresses or name variants may require administrator approval.
Reply-Chain Hijacking Detection
Participant and sender changes inside an existing thread
Tracks conversation participants and warns when an address or sender domain changes during a thread. This deterministic signal is particularly useful for invoice and payment-redirection fraud.
Known limitations
- Legitimate recipient additions and role transfers may also be flagged.
- Available conversation context differs between Outlook, Gmail, and Yahoo Mail.
- A compromised existing participant account may not introduce a new address.
Sender and Domain Reputation
First-contact and unexpected-domain alerts
Flags unfamiliar senders and domains using trusted-domain configuration, known-sender history, address validation, and available authentication or routing context.
Known limitations
- Legitimate first-contact messages can generate warnings.
- Accuracy improves as trusted senders and domains are maintained.
- External reputation and DNS availability can vary.
Deceptive Link Detection
Visible-destination, look-alike, and unsafe URL checks
Inspects available links for visible-text mismatches, Punycode or mixed-script deception, embedded credentials, IP destinations, unusual ports, suspicious host structure, brand mismatches, and sender-domain differences.
Known limitations
- A legitimate external service may use a domain different from the sender.
- Recognised social and email-tracking providers receive narrowly scoped exemptions.
- SpoofShield cannot guarantee the safety of content that changes after a link is opened.
Attachment Security
Executable, disguised, and encrypted-file checks
Checks available attachment names, MIME types, file signatures, script or executable indicators, double extensions, and password-protected archives.
Known limitations
- Inspection depends on whether the email platform makes attachment bytes available.
- Encrypted archives cannot be fully inspected without their password.
- This feature does not replace endpoint antivirus or sandbox detonation.
Content Scam Detection
Billing, storage, tax, password-reset, and support-scam patterns
Looks for combinations of language and context associated with common consumer and business scams, including urgent billing failures, storage-loss threats, tax notices, password-reset lures, and fake technical support.
Known limitations
- Pattern coverage varies by language and scam family.
- Legitimate urgent notices can resemble scam language.
- A message with little text may not provide enough evidence.
Payment and Wire-Fraud Detection
Bank-detail, invoice, gift-card, and transfer manipulation
Combines payment language, urgency, identity, recipient, and conversation-change signals to identify possible BEC and payment-diversion attempts.
Known limitations
- Legitimate finance messages may contain similar terminology.
- The strongest results come from multiple independent signals.
- Every payment change should still be verified through a trusted channel.
Risk Scoring Engine
Composite signal aggregation into Low, Medium, and High risk
The scoring engine does not detect threats independently. It combines deduplicated signals from active engines and applies severity weights and administrator thresholds. Repeated links with the same issue contribute one concise finding rather than repeatedly increasing the score.
Known limitations
- Risk level reflects combined evidence, not an absolute guarantee.
- Disabling engines reduces available coverage.
- Administrator thresholds affect which alerts are shown.
What SpoofShield cannot detect
- Every attack sent from a legitimately compromised account.
- Malicious behaviour that occurs entirely outside supported email clients.
- Social engineering conducted only by phone, text message, or another messaging platform.
- Every novel attacker-controlled domain or newly invented deception technique.
- Content hidden by encryption or formats the email platform does not expose.
- Actions taken before SpoofShield is installed, active, and able to inspect the message.
How to maximise accuracy
- Keep VIP contacts currentInclude executives, finance approvers, administrators, and other impersonation targets.
- Maintain trusted senders and domainsApprove legitimate relationships while retaining independent security checks.
- Train users to verify context changesNew recipients, sender-domain changes, and payment changes should be verified outside the email thread.
- Use an appropriate alert thresholdHigh-risk roles may benefit from a more sensitive threshold than general users.
- Review organisation alerts regularlyRepeated attempts and targeted patterns are easier to identify across time.
Complementary security controls
- Secure email gateway or provider-level filtering.
- DMARC, DKIM, and SPF enforcement for organisation domains.
- Multi-factor authentication and strong account-recovery controls.
- Regular phishing and BEC awareness training.
- Independent callback verification for payment or account changes.
- Endpoint antivirus, attachment sandboxing, and incident-response procedures.
Questions about these figures or our methodology?
support@spoofshield.net