iCoreHosting Official Knowledgebase Article Structure
Why Anti-Spam Systems Cannot Block All Scam Emails
Table of Contents
Service Direction / Introduction / Scope
Some scams contain no malware or suspicious links and may come from a compromised real mailbox. Email authentication can pass while the request is fraudulent. Verify payment and bank-account changes through a trusted process.
This guide covers verification of payment and bank-detail instructions.
Service Transparency
Filters assess reputation, authentication, content, links and attachments. A text-only request from a compromised real account may pass these checks. Filtering cannot independently verify your supplier’s bank details or your internal approvals.
Definitions
- SPF, DKIM and DMARC: Email authentication mechanisms; they do not prove a business instruction is legitimate.
- Compromised mailbox: A real email account accessed by an unauthorized person.
- Bank-detail change scam: A request intended to redirect payment to an attacker-controlled account.
Description of Content / Step-by-Step Guide
- Hold the request
- Do not change payment records based on email alone.
- Treat urgent invoices or new bank details as requests to verify.
- Use a known number
- Call the sender using previously verified contact details.
- Do not use the number inside the suspicious email.
- Speak to a trusted contact
- Confirm the change with a known person at the company.
- Check the request independently even if the email signature looks normal.
- Request supporting records
- Request an official signed document for bank-detail changes.
- Verify it through your established process; a document alone is not proof.
- Use two-level approval
- Require a second authorized person to approve bank changes or large payments.
- Keep a record of who verified and approved the request.
- Proceed only after verification
- If verification is incomplete, do not pay or update records.
- Report suspicious requests to your IT or support team.
Important Note
SPF, DKIM and DMARC authenticate aspects of email delivery. They do not prove that a payment instruction is genuine or that a mailbox is uncompromised.
Common Mistakes
- Treating passing authentication as proof of a valid payment request.
- Calling the new number supplied in the suspicious email.
- Updating payment records without independent verification and approval.
Responsibility Breakdown
Customer / organization: Review suspicious messages, protect credentials and verify unusual requests through trusted contacts. Maintain appropriate internal approval and device-security procedures.
iCoreHosting: Review reported hosting-email or filtering issues within the applicable service scope using the information provided.
Third parties: External email providers, software vendors and business contacts control their own systems and must independently confirm requests relating to them.
Limitations
No filter or guide can guarantee that every scam is detected. Authentication, familiar branding or a clean scan is not proof of a genuine request. This guidance does not guarantee prevention, recovery or a particular investigation outcome.
Support Information
Contact iCoreHosting Support through the official channel. Include the affected address, approximate date and time, a short description and full email headers where available. Share sensitive evidence privately; never send your password or OTP.
FAQ
Why can a scam pass filtering?
It may contain no harmful file or link and may come from a real compromised account.
Does a signed document prove a bank change?
No. Verify it through established contacts and your approval process.
What if I cannot verify the request?
Do not make the payment or change records until verification is complete.
Use Case
Situation: A supplier’s familiar email account requests that today’s payment go to a new bank account.
Action: Hold the payment, call a previously verified contact number and obtain the required independent approvals.
Expected result: The team can assess the request before changing records or sending money.
Summary
Treat filtering as one layer of protection. Verify payment instructions through trusted contacts, documented checks and appropriate approval.