Why do phishing emails have spelling and grammar mistakes?

Question

Are the spelling and grammar mistakes in phishing emails done on purpose? Is there some wisdom behind it? Or they are simply indicative of the fact that they've been written by someone who does not natively speak English?

Answer 1

This may well be for the same reason as many scammers rely on the tired old 'Nigerian Prince' strategy: by self-selecting for gullible targets, they can be more efficient.

In phishing, as in scams, sending the initial batch of emails is the easy part. The hard part is coaxing information out of the target (which can require a concerted exchange of emails). That can represent a significant investment of time.

As a result, it's really important to ensure that the people you correspond with may actually give you the information that you're after. It can therefore be advantageous to send a badly-drafted email, on the basis that the people who respond to that are likely to be gullible enough to be phished.

(I would probably draw a distinction between these broad, drag-net approaches and targeted phishing, where you're much more likely to see carefully-crafted and legitimate-looking emails.)

Answer 2

Emails with mistakes are probably from people who don't know English well enough to write it correctly.

Many phishing emails do not have mistakes and may be copied directly from emails sent by the company they claim to represent.

See this for more details: "Phishing" red flags and countermeasures

Answer 3

Spam filters work by looking for certain words. (among many other test)

If these words are misspelled, the filter won't recognize them.

Answer 4

Is it possible that by appearing to be less intelligent they seem (perhaps even subconsciously) to be less of a threat?

I mean, there's no way somebody who confuses you're and your could fool someone as smart as me!

Answer 5

There are some good points in the answers, but I think we need to clarify a few definitions. There is a difference between spam, sometimes referred to as unsolicited commercial email and phishing, attempts to get the user to respond to a link, open an attachment or perform some other action which either assists in the installation of malware or fools the user into providing sensitive data, such as their username and password.

With spam, the spelling and grammar errors are often due to both attempts to get past spam filters and the messages being written by someone who is not a native english speaker. With phishing, the causes are similar, but often you see less grammar and spelling errors than traditionally seen in 'old style' spam.

However, the main point I wanted to make was that using grammar and spelling as an indicator of either spam or phsshing is becoming less useful. These days, with the growing commercialisation of both spamming and phishing in particular, those undertaking these activities are becoming a lot more sophisticated. They will use existing filtering technology to test their messages and find ways to bypass filters. They are also very much aware that many people use bad grammar and spelling as red flags and are therefore taking more care.

In particular, spear phishing is definitely on the increase and those who initiate spear phishing campaigns are taking significant care to ensure their messages look professional and very convincing. There are now organisations out there who will provide a commercial high quality service for mounting phishing campaigns. The emails have increasing amounts of personal information, such as referring to you by your actual name, job title or some other personal refeence and frequently will appear to have come from someone you know, you work with or a senior person in your company who has authority and who you are more likely to respond to.

Noyyom linr,grammar and spelling mistakes are of decreasing value for identifying either spam or phishing emails. The increased sophistication in such campaigns means we need to be vary concious of this change and more vigalant. A belief that spam and phishing emails have bad grammar and spelling is likely to increase our vulnerability to well crafted emails. We need to use other techniques, such as being ware of any unusual or non-standard request - especially those which don't follow normal work practices or policies. We need to be even more vigilant regarding opening of attachments, following links or providing sensitive details via email. Whenever we receive a message which either urges immediate actions, raises fears about something which may have occurred, offers something which sounds too good to be true or warns us that something terrible will happen if we don't do something, we need to stop and think about what the actual motives underlying that message might be.

The other limitation of using grammar and spelling as an indicator is that there are increasing numbers of legitimate messages which include such things - even some of these responses have both. The world is shrinking, but english does seem to be the main language of the internet. As non-english speaking countries become more connected and as more and more IT services are moved off shore, we see increased numbers of legitimate messages authored by people who are not native english speakers. There is also an increasing tendency for people to value speed over accuracy, so spelling and grammar errors seem to be increasingly accepted. We should also remember that even in english, there is differences in spelling and grammar - for example US and British spelling, match versus maths etc