Why email filters miss phishing in chat apps

Many companies have invested well in email security, and it shows. Phishing emails are caught and quarantined every day. But attackers follow the gaps, and the gap is that people do not only work in email. This post explains where links arrive now, why attackers use those channels, and how to close the gap.

Where links arrive now

A link that could lead to a fake login page can reach your team through:

• WhatsApp and other messaging apps, on personal and work phones.
• SMS, such as a fake courier or bank alert.
• Team chat, such as a message in Teams or Slack, sometimes from a real but compromised partner account.
• Social media messages and direct messages.
• Search results and adverts, where a fake login page appears above the real one.
• QR codes on posters, packaging and even printed letters.

None of these pass through the email filter, so the filter cannot see them.

Why attackers use these channels

• There is nothing in the way. Chat apps and SMS have no company-wide filter checking each link.
• Messages feel personal and urgent. A short message from “a supplier” or “the CEO” lands differently from an email.
• People use personal devices. The same phone is used for work and for everything else.
• Small screens hide addresses, so fake links are harder to spot.
• Trust travels. A message from a real contact whose account has been taken over is the hardest kind to doubt.

For examples of how these scams read, see smishing, vishing and quishing explained.

What one click can do

One click from one employee can lead to a stolen password, a session taken over, or software installed on a device. It does not take a large number of mistakes, only one that no one saw.

Where email security stops and where it does not

Place a link arrives	Seen by email security?
A work email	Yes
WhatsApp or another messaging app	No
SMS	No
Team chat	No
A search advert or a social media message	No
A QR code	No

Closing the gap

No single control is enough. Sensible layers include:

• Awareness, so people know what a rushed request looks like. What phishing is and how it works is a good starting point for staff.
• Strong sign-in, such as two-step verification, so a stolen password is not enough.
• Email security, which you should keep.
• Link checks at the moment of the click, wherever the link came from.

That last layer is where RIEG fits. It checks links when someone clicks them on Windows, on Android and in the browser, and warns or blocks before a dangerous page opens. It does not replace your email security. It covers the places email tools do not reach.

Questions to ask about your own setup

• Where do our people actually receive links? Do we know?
• Which devices are in scope, and who manages them?
• If one click went wrong today, how would we find out?
• Can we show an auditor what we check, beyond email?

If you want to see what that looks like for your team, read how to roll out link protection across a team, or ask for a free 30-day pilot.