DMARC: The DMARC (Domain-Based Message Authentication, Reporting, and Conformance) email authentication protocol enhances security and prevents email spoofing and phishing attacks. DMARC works in correlation with the SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail). The SPF is an email authentication method that allows the domain owner to specify which email servers are authorized to send emails on behalf of their domain. It creates a list of authorized sending IP addresses in the domain’s DNS records. When an email is received, the recipient’s email server can check the SPF record to verify whether the sending server is authorized to send emails for that domain. DKIM is another email authentication method that adds a digital signature to outgoing emails. The domain owner generates a unique private key and publishes the corresponding public key in the DNS records. The private key is used to generate a digital signature that is attached to the email header. When the recipient’s email server receives the email, it can retrieve the public key from the DNS records and use it to verify the digital signature. This ensures the sender’s domain authenticity. DMARC builds upon the SPF and DKIM to provide a more comprehensive email authentication framework. It enables the domain owner to define a policy for how the receiving email server should handle emails that fail the SPF or DKIM checks. The DMARC policy can instruct the recipient’s server to either quarantine or reject emails that fail authentication. Additionally, DMARC offers reporting mechanisms that grant domain owners the ability to monitor the usage of their domains for email authentication purposes. It generates comprehensive reports containing details about the emails sent on behalf of the domain, including the outcomes of the SPF and DKIM authentication (whether they passed or failed). These reports play a crucial role in assisting domain owners in detecting any unauthorized utilization of their domains, resolving authentication problems, and obtaining valuable insights into potential phishing attempts [21,22]. In conclusion, DMARC offers protection against domain-spoofing emails, preventing them from reaching users’ inboxes. Through DMARC, it is possible to block, quarantine, and monitor any malicious emails sent from the controlled domain. Numerous email providers, including Google’s Gmail-hosted mailboxes and Microsoft’s Office365, offer support for DMARC policies [23]. Typically, mail-filtering techniques like DMARC are specifically crafted to operate based on the header information within emails. The email-filtering policy is formulated to examine both incoming and outgoing emails, aiming to prevent any suspicious messages originating from deceptive domains. However, this approach exhibits vulnerabilities when it comes to impersonation attacks, wherein emails may originate from domains that fall outside the scope of the filter. Furthermore, the limitation of mail-filtering techniques lies in their exclusive focus on the email header. Consequently, they prove ineffective at safeguarding the email system against certain types of attacks, particularly those rooted in content manipulation. For instance, schemes involving fraudulent invoices, in which the email content itself is manipulated, pose a significant challenge, as the current mail-filtering approach does not extend its protective measures to this aspect of the email composition [24]. As Särökaari [25] also mentions in his thesis, deploying the SPF and DMARC is not enough to prevent sophisticated and targeted phishing attacks. Furthermore, if an attacker is able to gain access to an employee’s email account, having these countermeasures will not provide any protection, as the attacker is in a position to impersonate the compromised user by having access to their email inbox. Moreover, as Särökaari states, the adoption of these technical security control measures has been largely voluntary, with little penalty for noncompliance;

Antivirus–antimalware software: BEC attacks rely on careful and sophisticated planning, involving OSINT investigations to gather critical information about the target. The purpose is to establish psychological leverage and gain valuable insights that can be utilized in future fraudulent emails. However, apart from such meticulous approaches, attackers can employ more direct and intrusive techniques, such as utilizing viruses or malware to compromise the victim’s system and extract sensitive data. Key loggers [26] are an example of such malware, recording the victim’s keystrokes and thereby capturing sensitive information, like login credentials, usernames, and passwords. Another example is remote-access tools (RATs) [27], which aim at obtaining unauthorized system access for further exploitation. Moreover, BEC attackers often resort to social engineering tactics, such as sending initial emails containing malicious URLs. These deceptive links mislead the unsuspecting victims into installing the malicious software into their systems or entering fraudulent websites that mimic legitimate platforms, like e-banking sites. Once on these fake websites, victims may unknowingly disclose their confidential information, allowing the attackers to perpetrate identity theft or financial fraud or gain unauthorized access to systems. Given the evolving sophistication of BEC attacks and other forms of cyber threats, antivirus and antimalware software has become an indispensable tool for organizations and individuals to protect themselves from potential harm. These security measures aid in detecting and mitigating various forms of malicious software and deceptive tactics employed by cybercriminals, thereby reducing the risk of falling victim to BEC schemes and similar cybercrimes [28];

Machine learning algorithms: Machine learning is a field of study within artificial intelligence that focuses on developing algorithms and models capable of learning from data and making predictions or decisions. When it comes to business email compromise (BEC) attacks, machine learning can be a valuable tool in detecting and preventing such threats. Machine learning can help combat BEC attacks in several ways [29]. Firstly, it can be used to analyze historical email data and identify patterns associated with known BEC attacks. By training machine learning models on such data, they can learn to recognize common characteristics, such as suspicious email addresses, language patterns, or anomalies in email headers. Additionally, machine learning algorithms can be employed to analyze email content and attachments in real time. These algorithms can learn from a variety of features, such as the email’s structure, sender’s reputation, language used, and contextual information. By leveraging these features, the models can identify suspicious emails that exhibit characteristics commonly associated with BEC attacks, such as unexpected changes in account details or urgent requests for funds. Furthermore, machine learning can assist in identifying compromised accounts or unauthorized access attempts. By monitoring the user behavior and detecting deviations from normal patterns, machine learning models can flag potential unauthorized activities, such as login attempts from unfamiliar locations or unusual timeframes. A. Cidon et al. [30] presented BEC-Guard, a detector employed at Barracuda Networks that uses supervised learning to stop business email compromise threats in real time. BEC-Guard detects attacks by using supervised learning algorithms that are trained on an email database that contains millions of emails. These algorithms analyze the header of the email and search for suspicious phrases and links in the email body. Furthermore, BEC-Guard makes use of the public APIs provided by cloud email providers to automatically acquire knowledge about the past communication patterns of each organization. It also employs these APIs to promptly isolate and quarantine emails in real time. According to the writers, BEC-Guard was evaluated using a commercial dataset comprising over 4000 attacks, achieving a precision of 98.2% and a false-positive rate of less than one in five million emails. A drawback of this methodology is the need to continuously train the algorithm due to the continuous evolution of BEC schemes.

Furthermore, Cohen et al. [31] present a technique for identifying malicious emails through the utilization of machine learning methodologies. By extracting features from complete emails, including the header, body, and attachments, and employing a Random Forest classifier, the approach asserts an impressive accuracy level of 92.9%, with true-positive and false-positive rates standing at 94.7% and 3%, respectively. The dataset used in the performance evaluation was a collection of 33,142 emails (20,307 benign and 12,835 malicious emails) collected between 2013 and 2016. The malicious emails were labeled as such by at least five different antivirus engines using VirusTotal;

Encryption: Encryption serves as an effective measure to prevent data breaches by necessitating a pair of cryptographic keys for both the sender and receiver [32]. For example, in identity-based encryption (IBE), the user’s email address functions as the public key, and a centralized entity referred to as the Private Key Generator (PKG) is responsible for generating private keys. Following a preliminary authentication process, the private keys are securely transmitted from the PKG to end users through a secure channel. It is worth noting that identity-based encryption (IBE) schemes are susceptible to the key theft problem, enabling the PKG to decrypt any message [32].

Emails can also be safeguarded through various plugins [33]. Mailvelope [34] employs manual key management, requiring users to distribute and handle keys manually, which impacts the usability, especially for novice users. Plugins such as Jumble Mail and Secure Gmail [35] rely on PGP and encrypt messages using their managed keys, requiring end users to trust the provider. Routi et al. [36] conducted a study on PGP with the Mailvelope plugin. Despite considerable enhancements in Mailvelope security, its usability remains low and proves challenging for common users lacking knowledge of public-key cryptography. Other solutions, like Private Webmail, Virtu, and Xmail, generate and distribute encryption keys on their servers while concealing the key management process. However, these solutions are paid, and the unavailability of source codes raises trust concerns for end users;

Multi-factor authentication (MFA): MFA offers a robust method of authentication, demanding two or more verification factors to grant access to a resource [37,38];

Trusted Third Parties (TTPs): Ensuring the secure distribution of public keys to the correct parties can pose significant challenges. The trust placed in the public-key infrastructure (PKI) is of the utmost importance. A trusted third party is often needed to facilitate the provision of public- and private-key pairs. The entire security of the system relies on this trusted entity. Any compromise, whether from external attacks (like server code modification) or internal vulnerabilities, has the potential to undermine the security of the entire system. Consequently, organizations may harbor doubts regarding the trustworthiness of the third party responsible for issuing keys or credentials. Concerns may arise regarding the security practices of the provider, their adherence to regulatory compliance, and their ability to withstand external pressures that could jeopardize the integrity of the key management process. Organizations may hesitate to place their trust in a third-party key management center that fails to demonstrate adherence to relevant standards and best practices. Additionally, concerns may arise regarding the location of the key management center and its compliance with data sovereignty requirements. Certain regulations mandate that specific data must remain within defined geographical boundaries, and relying on a third-party provider may raise questions about data jurisdiction. The utilization of PKI methods usually requires that organizations entrust an external entity for building secure communication between users, thereby relinquishing a certain degree of control over the cryptographic keys. Some organizations may be reluctant to surrender this control, particularly when dealing with highly sensitive information. Depending solely on a specific key management provider may result in vendor lock-in, making it difficult and costly to switch to an alternative provider. Organizations may have reservations about relying solely on a single provider for a crucial security function. Additionally, the costs associated with utilizing a key management center can be a determining factor, and organizations require assurance that they can conduct audits and verify the key management processes to ensure compliance and security. The lack of transparency from the key management center can pose a significant obstacle in establishing trust. This involvement of TTPs underscores their significance in fostering secure, fair, and trustworthy email interactions, making them valuable components in the architecture of communication systems. According to Kupcu [39], due to the fact that numerous systems depend on trusted third parties (TTPs) for assurances in fairness, security, and efficiency, there is a critical necessity to decentralize the trust placed in these central entities. Moreover, Paulin et al. [40] state that current service providers offer limited solutions dependent on a trusted third party, hindering their applicability across borders, especially in transnational unions such as the EU. The authors introduce a functional certified email system that achieves the fair non-repudiation of receipt without relying on a trusted third party. The proposed protocol involves encrypting a message and splitting it into a chain of parts, with the recipient gradually acquiring each part and generating proofs-of-receipt for the individual segments. This protocol cryptographically prevents the addressee from obtaining the message in case they terminate the protocol prematurely. The universality of the presented system makes it feasible for unobtrusive operation using existing user agents and email providers. Sabir et al. [33] mention that, in contrast to other applications, like social media, email accounts inherently contain more sensitive data, making a hacked email account a potential source of personal information leakage and unauthorized access to various online services. Moreover, despite users relying on service providers for email privacy, this trust is often exploited for targeted advertisements. Additionally, the risk of attackers targeting and compromising numerous email accounts underscores the vulnerability of email systems, especially when considering the danger of an attack on the internal server itself. For the abovementioned reasons, the authors devised a solution using a PKI (public-key infrastructure) similar to that of Proton Mail [41] with the following objectives. Firstly, the system aims to ensure complete end-to-end privacy. Secondly, it strives for significant usability aligned with the Saltzer acceptability principle, aiming to enable users without technical expertise to navigate the system effortlessly, including aspects such as obtaining, distributing, and utilizing cryptographic keys. Thirdly, portability is emphasized, allowing users to switch between public computers without reliance on a specific device. Fourthly, users are not required to install additional hardware or software configurations to use the system. Lastly, the trustworthiness of the application code is highlighted, emphasizing a transparent, cryptographic key-sharing mechanism to instill user confidence.

An interesting work is that of AlSabah et al. [42], which presents a secure end-to-end email communication approach. By employing their innovative certificate-less (CL) key agreement protocol, the method enables users to update their public keys without requiring interaction with the certificate authority (CA).

Moreover, Brown et al. [43] introduced a proxy-based architecture. Proxy-based methods utilize their servers for encrypting and decrypting messages, making them not genuinely end-to-end secure. Jammalamadaka et al. [44] proposed a proxy-based design that necessitates additional hardware (a mobile phone) to execute secure email operations. Another Windows-based system, Opaque-Mail, communicates with mail clients and requires local installation on all users’ devices. Additionally, proxy re-encryption, by design, has an insignificant impact on email privacy. Moreover, user trust could be manipulated by introducing backdoors through application source codes.

Finally, Secure/Multipurpose Internet Mail Extensions (S/MIMEs) serve as an encryption standard akin to PGP, ensuring the security of email content. Built on public-key cryptography, S/MIMEs mandate the involvement of certificate authorities (CAs) in issuing certificates for both the sender and receiver. This approach necessitates mutual trust in the CA. Despite some companies opting for self-issued certificates, these are often perceived as untrustworthy, potentially introducing security vulnerabilities. Additionally, S/MIMEs fall short in safeguarding users against Vendor Email Compromise (VEC) attacks, particularly when utilizing servers that store users’ private keys on the servers. It is crucial to acknowledge that no single method can offer comprehensive protection against fraudulent schemes. While S/MIMEs provide the confidentiality and integrity of contents, they are considered weak against VEC attacks. Consequently, it is advisable to employ a combination of security measures, including TLS, S/MIMEs, and the suggested method, to fortify a company’s defense against such attacks [24];

Digital signatures: Digital signatures in email communication are instrumental in fortifying the security and reliability of electronic exchanges. These signatures, generated through cryptographic algorithms, assure the authenticity of the sender and the integrity of the message content. This form of security prevents unauthorized access and tampering during transmission, offering a vital defense against cyber threats. Moreover, digital signatures provide a crucial element of non-repudiation, making it challenging for senders to deny their involvement in a specific message. This not only enhances accountability but also minimizes the risk of disputes over message origins. In an environment where sensitive information is regularly shared, the adoption of digital signatures instills confidence, establishing a secure foundation for electronic communication [45,46]. Digital signatures, while offering significant advantages, are not without their drawbacks. A notable vulnerability is the issue of “unobservability” in electronic documents. This means that, in certain cases, the content of a digitally signed document may be concealed or difficult to discern. According to Lax et al. [47], unlike traditional documents that can be interpreted by humans through direct observation, digital documents rely on machine-level interpretation and require complex instruments such as computers for viewing and signing. This inherent complexity introduces vulnerabilities, particularly in ensuring the consistency and reliability of these instruments. The unobservability of digital documents poses a challenge to the direct link between the signature and the information’s integrity, making it inherently weaker compared to handwritten signatures. Despite technical measures addressing bit-level modifications, concerns persist regarding the reliability of the instruments used for viewing and signing documents, rendering digital signatures inherently weak. The paper highlights various vulnerabilities resulting from this unobservability and explores potential solutions, emphasizing the balance between security and usability in the context of digital signatures. Malicious actors can exploit disadvantages like the abovementioned to their advantage, compromising the transparency and verifiability that digital signatures aim to provide. To address this, there is a critical need for secure and efficient verification methods. Advanced algorithms can play a pivotal role in enhancing the verification process, ensuring that the integrity and authenticity of digitally signed documents are upheld [48]. Implementing sophisticated algorithms can mitigate the risks associated with unobservability, making it more challenging for malicious actors to manipulate or conceal electronic content.