It passed SPF and DKIM. It was still phishing.

transcript

This email passed SPF and DKIM. It's still phishing. Here's how the filter catches it anyway.

31 July, tax deadline night. A refund of 18,450 rupees. Just verify your bank account. Click here. The domain? Two days old. One letter off the real portal.

And it passes SPF and DKIM. For its own domain. Authentication proves where the mail came from. Not that the sender is honest.

So check reputation. A two-day-old domain has no history. It claims a government body. The link wants bank details. And lncome Tax. That's a lowercase L.

Filters that read dictionary words miss tricks like that. So Gmail moved to RETVec. It reads characters. Detection up 38 percent. False positives down 19 point 4 percent. And TPU use down 83 percent.

Authenticated, but unknown. And the content screams phishing. Verdict: Spam, with a warning. Never the inbox.

Authentication gives you an identity. Reputation and content decide whether to trust it.

Full breakdown in the lecture.