Are the spelling and grammar mistakes in phishing emails done on purpose? Is there some wisdom behind it? Or they are simply indicative of the fact that they've been written by someone who does not natively speak English?

  • 16
    Have you already heard about All your base are belong to us?
    – ott--
    Commented Aug 6, 2015 at 21:43
  • 69
    I've read that sometimes these mistakes are added on purpose. Only a fool would fall for messages full of errors. And scammers are looking for that kind of people.
    – Rob W
    Commented Aug 6, 2015 at 23:13
  • 5
    Cybercriminals don't necessarily have a good education, or speak the primary language of the email as a second language on the generic garbage spam. Most of the quality phishing email out there doesn't have these issues and is often indistinguishable at first glance from whatever corporation is being spoofed. Targeted spearfishes will be by people who have studied internal documents and communications flow and will attempt to closely emulate the education level of the person they wish the email to appear from, including the types of mistakes they would make. Commented Aug 7, 2015 at 6:12
  • 7
    @RobW For a 419 scam, sure. But for phishing? I don't buy it at all. The whole point of phishing is to look credible enough that people follow the link and give you their account details. Once you have their account details, you don't care how gullible they are. Sending spam is so cheap that, if you wanted to use mistakes to find extra-gullible people, it would make much more sense to send that as a separate shot: there's no reason to combine the two. Ockham's razor says that mistakes in phishing mails are because spammers are dumb, not because they're super-cunning and subtle. Commented Aug 8, 2015 at 12:31
  • 4
    @JustinLardinois Are you using a different definition of "phishing" to me? To me, phishing is a form of social engineering involving sending emails that look like they come from some organization the victim is associated with, such as their bank or email provider. My bank and email provider both speak excellent English: anyone who attempted to impersonate them but uses bad spelling and grammar is not going to succeed. Commented Aug 8, 2015 at 20:37

5 Answers 5


This may well be for the same reason as many scammers rely on the tired old 'Nigerian Prince' strategy: by self-selecting for gullible targets, they can be more efficient.

In phishing, as in scams, sending the initial batch of emails is the easy part. The hard part is coaxing information out of the target (which can require a concerted exchange of emails). That can represent a significant investment of time.

As a result, it's really important to ensure that the people you correspond with may actually give you the information that you're after. It can therefore be advantageous to send a badly-drafted email, on the basis that the people who respond to that are likely to be gullible enough to be phished.

(I would probably draw a distinction between these broad, drag-net approaches and targeted phishing, where you're much more likely to see carefully-crafted and legitimate-looking emails.)

  • 31
    Fascinating concept! Commented Aug 7, 2015 at 3:51
  • 19
    -1 as spelling mistakes are also as prevalent (if not more prevalent) in mass send mails that try to get you to log in on an automated fake login page without any manual interaction. In more targeted phishing where actual email exchanges occur the level of english tends to be far far better. Commented Aug 7, 2015 at 16:20
  • 3
    Yeah this is a nice thought, but I'm sure the grammar mistakes aren't that nefarious. English is a hard language, and it's not most people's first language. Commented Aug 7, 2015 at 21:12
  • 4
    Somewhat related, I think the same self-selecting effect works for homeopathy - "Yes all all physics signify that homeopathy does not work. But it works nevertheless." - although the supporters might not be as cynical as spammers and actually believe in it themselves.
    – hlovdal
    Commented Aug 7, 2015 at 21:29
  • 3
    From reading the paper, it is evident that they are simply theorizing about the problem. No Nigerians (or other spammers) were consulted. While an interesting analysis, it is not actually true.
    – ztk
    Commented Aug 12, 2015 at 13:31

Emails with mistakes are probably from people who don't know English well enough to write it correctly.

Many phishing emails do not have mistakes and may be copied directly from emails sent by the company they claim to represent.

See this for more details: "Phishing" red flags and countermeasures

  • 3
    Also to avoid detection - i.e. change a couple letters, and see if the spam filters still catch it Commented Aug 7, 2015 at 1:42
  • 3
    +1 I reazize this is quite a boring explanation, but I think that in the end it's actually the correct one. And either way, a couple of spelling mistakes probably don't matter that much, because people who are dumb/gullible enough to enter their bank login information on a random internet page are probably dumb/gullible enough to not wonder for too long about a couple of spelling and typing mistakes. Commented Aug 7, 2015 at 16:25
  • I'm getting lots of spam that is not written in English at all (not that it's written well in my native language either)…
    – Bergi
    Commented Aug 8, 2015 at 16:35
  • In case anyone else is wondering about the comment from @HasanKhan : quora.com/Which-is-correct-people-who-doesnt-or-people-who-dont
    – kR105
    Commented Aug 9, 2015 at 10:38
  • 2
    @HasanKhan, I loved the comment. Initially 'doesn't' was a mistake, but I thought it was pretty funny so I left it in.
    – ztk
    Commented Aug 12, 2015 at 13:29

Spam filters work by looking for certain words. (among many other test)

If these words are misspelled, the filter won't recognize them.

  • 13
    -1 as phishing mails tend to replicate official mails and the words in official mails are not words that a spam filter will tend to block (unlike words in actual spam mails). Commented Aug 7, 2015 at 16:21
  • 7
    Well, if typos are indicative of spam, they will be recognized very fast. Commented Aug 7, 2015 at 17:59
  • 1
    There are far more possible typos than correct texts.
    – chepner
    Commented Aug 7, 2015 at 21:14
  • 4
    This answer isn't really correct. Bayesian filtering doesn't care about spelling, and spam filters are quite good at using spelling errors to aid in their detection. V1@gra vs Viagra is trivial to filtering software.
    – Rocky
    Commented Aug 8, 2015 at 3:44
  • 2
    Absolutely not true. Well designed bayesian filters will weight unknowns negatively, therefore misspellings will be flagged.
    – bic
    Commented Dec 10, 2015 at 22:25

Is it possible that by appearing to be less intelligent they seem (perhaps even subconsciously) to be less of a threat?

I mean, there's no way somebody who confuses you're and your could fool someone as smart as me!

  • 1
    Although it might not be deliberate, I think this is a good point. I spend far longer (within my role as IT support) looking at convincing emails than badly made ones. More convincing = more of a threat.
    – Prinsig
    Commented Aug 7, 2015 at 13:02

There are some good points in the answers, but I think we need to clarify a few definitions. There is a difference between spam, sometimes referred to as unsolicited commercial email and phishing, attempts to get the user to respond to a link, open an attachment or perform some other action which either assists in the installation of malware or fools the user into providing sensitive data, such as their username and password.

With spam, the spelling and grammar errors are often due to both attempts to get past spam filters and the messages being written by someone who is not a native english speaker. With phishing, the causes are similar, but often you see less grammar and spelling errors than traditionally seen in 'old style' spam.

However, the main point I wanted to make was that using grammar and spelling as an indicator of either spam or phsshing is becoming less useful. These days, with the growing commercialisation of both spamming and phishing in particular, those undertaking these activities are becoming a lot more sophisticated. They will use existing filtering technology to test their messages and find ways to bypass filters. They are also very much aware that many people use bad grammar and spelling as red flags and are therefore taking more care.

In particular, spear phishing is definitely on the increase and those who initiate spear phishing campaigns are taking significant care to ensure their messages look professional and very convincing. There are now organisations out there who will provide a commercial high quality service for mounting phishing campaigns. The emails have increasing amounts of personal information, such as referring to you by your actual name, job title or some other personal refeence and frequently will appear to have come from someone you know, you work with or a senior person in your company who has authority and who you are more likely to respond to.

Noyyom linr,grammar and spelling mistakes are of decreasing value for identifying either spam or phishing emails. The increased sophistication in such campaigns means we need to be vary concious of this change and more vigalant. A belief that spam and phishing emails have bad grammar and spelling is likely to increase our vulnerability to well crafted emails. We need to use other techniques, such as being ware of any unusual or non-standard request - especially those which don't follow normal work practices or policies. We need to be even more vigilant regarding opening of attachments, following links or providing sensitive details via email. Whenever we receive a message which either urges immediate actions, raises fears about something which may have occurred, offers something which sounds too good to be true or warns us that something terrible will happen if we don't do something, we need to stop and think about what the actual motives underlying that message might be.

The other limitation of using grammar and spelling as an indicator is that there are increasing numbers of legitimate messages which include such things - even some of these responses have both. The world is shrinking, but english does seem to be the main language of the internet. As non-english speaking countries become more connected and as more and more IT services are moved off shore, we see increased numbers of legitimate messages authored by people who are not native english speakers. There is also an increasing tendency for people to value speed over accuracy, so spelling and grammar errors seem to be increasingly accepted. We should also remember that even in english, there is differences in spelling and grammar - for example US and British spelling, match versus maths etc

  • 2
    In a well-written post about grammar and spelling, I almost hesitate to ask -- what the $expletive $disparagement does 'Noyyom linr' mean? Commented Dec 10, 2015 at 9:52
  • 4
    Noyyom linr is really close on the keyboard to 'bottom line'... but not sure... my guess is that's intentionally ironic :) Commented Dec 10, 2015 at 16:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .