- Phishing and business email compromise are the highest-probability route into a government mailbox, because official titles, org structure and payment processes are usually public.
- A secure email gateway will not stop lookalike-domain fraud on its own; DMARC has to sit at enforcement (p=reject), not monitoring (p=none).
- Moving mail to Microsoft 365 or Google Workspace shifts the hard work to tenant configuration: conditional access, DLP and audit logging, not just the filter in front of the inbox.
- Auditors now ask for evidence: phishing simulation results, DMARC aggregate reports, and incident logs tied to specific email events, not a policy document describing intent.
What actually counts as an email threat here
Four patterns cover almost everything that reaches a government inbox. Phishing uses a generic lure, a fake login page or a spoofed invoice, sent broadly. Spear phishing targets a named individual using details pulled from a tender portal, an org chart or a public profile, and it converts far more often because the message reads as plausible. Business email compromise skips malware entirely: it compromises or spoofs a real mailbox, then redirects a payment or approval using the trust already built into an existing thread. Malware delivery still happens through attachments, but the container has moved from macro-enabled Office documents to ISO images, password-protected archives and OneNote files that dodge signature-based scanning.
Why ministries and authorities draw more of this than a typical enterprise
Government entities publish more of the reconnaissance an attacker needs than most private companies do. Tender portals list procurement officers by name and title. Press releases name department heads. Email address formats are predictable once one address leaks, firstname.lastname at the entity's gov.ae domain is common, so a spoofed sender needs no breach at all, only a plausible display name. Payment and permit approvals often move through a small number of known signatories, which makes a business email compromise attempt against a finance or procurement inbox a higher-value target than the same attempt against a mid-size private firm. None of this means government email is inherently weaker on the technical side; it means the attacker's reconnaissance cost is lower, so the volume and specificity of attempts is higher.
How the attacks actually run
Credential harvesting that mirrors a real portal
The most effective spear phishing against government targets does not ask for a password directly. It links to a page cloned from a real internal portal or from a national digital identity service, hosted on a freshly registered domain that survives just long enough to harvest a session. Because the page looks correct, and the link often arrives through a compromised vendor thread rather than cold, standard advice like checking the sender address catches less of this than it used to.
Payment and approval fraud
Business email compromise against government finance teams follows a predictable shape. The attacker either compromises a vendor's mailbox or spoofs a lookalike domain, inserts themselves into an existing invoice or payment thread, and changes the bank details on the next instalment. It rarely trips a malware scanner, because there is no attachment or link to detonate, only a plausible request from what looks like an ongoing relationship.
Malware and quishing that slip past URL scanners
QR-code phishing, usually called quishing, has become common specifically because most secure email gateways still scan the URLs in text and attachments, not the image content of an embedded QR code. The user scans it on a personal phone, which is usually outside the corporate security stack entirely, and lands on a credential page with no gateway anywhere in the path.
The controls that actually change outcomes
A gateway that only inspects mail at the perimeter misses anything that changes after delivery: a link that is clean at scan time and turns malicious an hour later, or a lure sitting inside a legitimate but already-compromised vendor thread. Closing that gap needs time-of-click link rewriting and continuous, API-based scanning of mail already sitting in the mailbox, which is where products like Microsoft Defender for Office 365 and Mimecast differ meaningfully from a basic spam filter.
DMARC is the other half most programmes get wrong. Publishing a DMARC record at p=none tells you who is spoofing your domain; it does nothing to stop them. Moving to p=quarantine and then p=reject actually blocks impersonation, but it takes weeks of reading aggregate reports first to find every legitimate sender, an HR platform, a payroll processor, a marketing tool, that sends mail as the government domain and would otherwise get blocked once enforcement is on. Vendors like EmailAuth exist mainly to make that discovery and staged rollout manageable across the dozens of subdomains that a large government entity with multiple departments tends to accumulate.
Phishing-resistant authentication, FIDO2 security keys or platform passkeys rather than SMS codes or push approvals, removes most of the value from a harvested credential, because the attacker cannot replay a session without the physical key. This matters more than another layer of filtering, because every control above is trying to stop the click, and this is the one that still works after the click happens.
Why these programmes stall inside government entities
Three patterns repeat across government email deployments. Legacy on-premises Exchange survives longer than in the private sector because migration touches sensitive mail archives that need extra sign-off, and that delay leaves older, less capable filtering in place in the meantime. Security ownership is split: IT runs the mail platform, the security team owns the gateway, and individual departments manage their own distribution lists and, often, their own subdomains, so a single DMARC policy or conditional access baseline needs sign-off from people who do not report to each other. And personal webmail keeps getting used for official business whenever the sanctioned system is slow or a mailbox quota is too small, which moves sensitive correspondence outside every control described above.
What auditors and assessors actually check
For an ISO 27001-aligned entity, or one working against NESA-referenced controls, an assessor rarely accepts a policy document as proof that email is controlled. What they ask for instead is evidence: phishing simulation results with click and report rates tracked over time, DMARC aggregate report history showing the domain actually moved from monitoring to enforcement, incident tickets that trace a specific email-borne event through detection, containment and lessons learned, and configuration exports showing conditional access and data loss prevention rules applied to the mail tenant, not just described in an architecture diagram. Cloud email makes this easier to produce, since Microsoft 365 and Google Workspace both expose audit logs and configuration state through their own APIs, but only if someone is pulling and retaining that evidence on a schedule instead of assembling it the week before an audit.
Where to start if the programme is behind
Fix the highest-impact gap first, which is almost always a DMARC record still sitting at p=none years after it was published. Pull ninety days of aggregate reports, identify every legitimate sending source, and move to enforcement in stages rather than in one jump. In parallel, replace push-based multi-factor authentication on any account with approval authority, finance, procurement, IT administration, with a phishing-resistant method. Gateway tuning, training cadence and quishing-specific detection all matter, but they compound on top of those two changes. They do not substitute for them.
