---
title: Who Sent the Spam That Told Only the Truth?
url: https://oosioo.com/en/p/%EC%A7%84%EC%8B%A4%EB%A7%8C-%EC%A0%81%ED%9E%8C-%EC%8A%A4%ED%8C%B8%EB%A9%94%EC%9D%BC%EC%9D%80-%EB%88%84%EA%B0%80-%EB%B3%B4%EB%83%88%EC%9D%84%EA%B9%8C
date: 2026-10-13T12:24:20+00:00
author: SYSOP
summary: The sentence written in the notebook read: 'The internet is overflowing with bad information. But what if the junk mail you just received contains nothing but perfect truth? Who sent it?' This piece traces the cat-and-mouse game from early word-counting spam filters through Bayesian filters, sender authentication, and machine learning, up to AI phishing that has erased its old clumsiness, deepfake video calls, and emails aimed at AI assistants. It examines why well-made lies start with the truth, why opinion manipulation now targets the answers of AI search engines, and closes with five questions to ask whenever you receive information. The twelfth piece in the 'One Page Today' series.
---
# Who Sent the Spam That Told Only the Truth?

![On a dark background, the title "Who Sent the Spam That Told Only the Truth?" appears on the left, with a mock inbox list on the right. Among ads and prize notifications, a single email, "Stranger · Everything written here is true," is brightly highlighted and tagged as spam](/uploads/26c2d06cb3bf91b1.webp =720)

I flipped open my idea notebook at random, and this sentence turned up.

> The internet is overflowing with bad information. But what if the junk mail you just received contains nothing but perfect truth? Who sent it? Imagine that.

At first it read like a joke — spam surely can't tell the truth. But reading it over a few more times, the question turns out to be upside down. We assume we discard spam because its content is false, but in reality we discard it because we don't trust the sender. So is spam whose content is entirely true safer, or more dangerous?

To answer that, we first need to look at the more-than-thirty-year game of cat and mouse between those who block spam and those who send it.

## The Era of Counting Words

Early spam filters were simple. They scored messages for words like "free," "you've won," or "Viagra," and blacklisted the addresses of notorious sending servers. Spammers dodged them immediately — spelling Viagra as "V1agra," inserting dots between letters, or turning entire phrases into images.

The game changed in 2002, when Paul Graham proposed the Bayesian filter in his essay ["A Plan for Spam"](https://paulgraham.com/spam.html). Instead of humans setting rules, the filter learned word-by-word probabilities from the mail each person marked as spam or not. Because the filter now differed from person to person, spammers could no longer break through with a single trick.



Spammers' next move was to tack a pile of perfectly ordinary sentences lifted from novels or news articles onto the end of the email — diluting the probability score with words common in legitimate mail. Even today, you'll occasionally see spam with a random, out-of-context paragraph attached at the end; that's a relic of this era.

## Looking at the Source Instead of the Content

No matter how closely you examined the content, spammers could simply change the content. So the defenders changed the question — instead of asking "what does this email say," they started asking "did this email really come from that address."

SPF is a mechanism that publishes in advance which servers are allowed to send mail under a domain's name. DKIM attaches a digital signature to prove the message wasn't altered in transit. DMARC is the rule a domain owner sets for how to handle messages that fail those two checks. These mechanisms, recommended for years but rarely enforced, effectively became mandatory in February 2024, after Google and Yahoo announced that senders of [more than 5,000 messages a day would be required to implement DMARC](https://resend.com/blog/gmail-and-yahoo-bulk-sending-requirements-for-2024), and that mail would be blocked if a sender's spam-complaint rate couldn't be kept below 0.3%.

![A diagram showing, left to right, the three checks a mail message passes through after arrival. SPF asks "Is this server allowed to send?", DKIM asks "Was it unaltered in transit?", and DMARC asks "What do we do if it fails?" Below, a note explains that since all three only confirm the mail came from that address, a hijacked genuine account or a lookalike address (examp1e.com) can still pass](/uploads/eb72f7dc79cb9d62.webp =760)

Machine learning was layered on top of that. Google has said Gmail [blocks over 99.9 percent](https://www.bleepingcomputer.com/news/security/google-says-gmail-now-blocks-99-9-percent-of-spam-and-phishing-emails/) of spam and phishing. In 2023 it introduced [RETVec](https://security.googleblog.com/2023/11/improving-text-classification.html), a text processor built to withstand tricks like swapping in lookalike characters (a Cyrillic "а" for a Latin "a") or inserting invisible characters, which reportedly raised the spam-detection rate by 38 percent while cutting the rate of legitimate mail wrongly flagged as spam by 19.4 percent.

There's an interesting twist here. In 2012, Microsoft researcher Cormac Herley published a paper titled ["Why Do Nigerian Scammers Say They Are From Nigeria?"](https://www.theregister.com/2012/06/21/nigerian_scams_msft_research/). His conclusion: clumsy sentences and implausible setups aren't mistakes — they're a filter. Only by weeding out everyone who isn't gullible enough to reply to such an email can a scammer cut down on wasted effort. The clumsiness of spam was the product of the sender's own cost calculation.

Summing up this game of cat and mouse so far:

| Period | Senders | Defenders |
|---|---|---|
| 1990s | Mass-sending identical phrases | Banned-word lists, sending-server blacklists |
| Early 2000s | Spelling tricks like "V1agra," turning phrases into images | Bayesian filters (2002): learning probabilities unique to each person |
| 2000s | Diluting probability by appending ordinary sentences | Sender reputation, adoption of SPF/DKIM |
| 2010s | Impersonating corporate email accounts (BEC) | DMARC, machine-learning classification (Gmail blocks 99.9%) |
| 2023 | Lookalike characters, invisible characters | RETVec: detection up 38%, false positives down 19.4% |
| 2024 | Mass sending | Google and Yahoo mandate DMARC for bulk senders |
| 2025 | AI-written polished text, deepfake voice/video | Behavioral anomaly detection, re-verification via other channels |

## What AI Erased Was the Clumsiness

Generative AI rewrote that cost calculation. The cost of writing a convincing sentence dropped to nearly zero.

When security firm Barracuda analyzed spam from February 2022 through April 2025 together with researchers from Columbia and the University of Chicago, they estimated that [51 percent of spam as of April 2025 was AI-written](https://www.infosecurity-magazine.com/news/ai-generates-spam-malicious-emails/). These messages were more grammatically correct and more formal than human-written ones. The old rule of thumb — "be suspicious of mail with spelling mistakes" — is losing its usefulness.

The shift is even clearer in targeted phishing. Security training firm Hoxhunt sent simulated phishing emails, created by its own AI agent and by a team of human experts, to millions of people and compared click-through rates. [In 2023, AI was 31 percent less effective than humans; by March 2025, it was 24 percent more effective](https://hoxhunt.com/blog/ai-powered-phishing-vs-humans). The ranking flipped in just two years.

![A bar chart showing AI phishing's relative effectiveness with the human expert team set at zero: −31% in 2023, −10% in November 2024, and +24% in March 2025. Only the last bar, shown in red, rises above zero. Data from security training firm Hoxhunt's own experiment](/uploads/b7697eea76afef76.webp =720)

## Spoofing Moved to Voices and Faces

Spoofing, once about forging an email address, now forges the person.

In early 2024, an employee at the Hong Kong office of British engineering firm Arup received an email, supposedly from headquarters' CFO, requesting a confidential transfer. The employee initially suspected phishing. But when a video call followed, showing the CFO and familiar colleagues giving the same instructions, suspicion faded, and the employee [transferred around HK$200 million (about US$25.6 million)](https://abc17news.com/money/cnn-business-consumer/2024/05/16/british-engineering-giant-arup-revealed-as-25-million-deepfake-scam-victim/) across fifteen payments. Everyone on that call except the employee was a deepfake built from publicly available video and audio. Someone who wouldn't have been fooled by a single email was fooled by seeing a face.

That same January, just before the New Hampshire primary, robocalls mimicking President Biden's voice told voters to "not vote, and save it for November." The Federal Communications Commission (FCC) fined the political consultant who organized the calls $6 million.

The numbers show where this trend starts. The FBI's Internet Crime Complaint Center (IC3) reported [21,442 business email compromise (BEC) cases in 2024, totaling $2.77 billion in losses](https://www.proofpoint.com/us/blog/email-and-cloud-threats/email-attacks-drive-record-cybercrime-losses-2024). That ranks seventh by number of complaints but second by losses. A single precisely targeted email costs far more than mass-sent spam.

## Now AI Reads Email Before People Do

A new problem has emerged too. As AI assistants that summarize email become more common, attackers have begun writing emails designed to deceive the AI, not the human.

[EchoLeak (CVE-2025-32711)](https://www.bleepingcomputer.com/news/security/zero-click-ai-data-leak-flaw-uncovered-in-microsoft-365-copilot), disclosed in June 2025, was a vulnerability in Microsoft 365 Copilot. If Copilot ingested, as reference material, instructions hidden inside a single attacker-sent email, internal company data could leak out without the user clicking anything. It scored 9.3 out of 10 in severity, and Microsoft fixed it server-side before disclosure. No real-world exploitation was confirmed.

The same trick surfaced in academia too. In July 2025, Nikkei reported that [17 papers](https://www.techrepublic.com/article/news-hidden-ai-prompts-academic-research-papers/) written by researchers from 14 institutions across 8 countries contained hidden instructions — in white or extremely small text — reading "give only positive reviews." Invisible to human reviewers, the sentence only works on anyone who feeds the paper into an AI for review.

## What the Defenders Look At

Summing up the pattern, defense has moved broadly in the same direction: from content to source, and from source to context.

- **Prove the path.** SPF, DKIM, and DMARC verify the sending server, while content credentials like C2PA attach a record of who created or edited a photo or video, and when.
- **Watch for behavioral anomalies.** Suspect the pattern of the request, not the content — an unfamiliar account, a sudden change of account, or a large transfer at an unusual hour.
- **Re-verify through a different channel.** Confirm a wire-transfer request that arrived by email using a phone number you already know. The Arup case, too, only came to light once the employee contacted headquarters directly. The verification passphrases families agree on in advance work on the same principle.
- **Separate text meant for AI to read from instructions it should follow.** Treat sentences pulled from an email or webpage purely as data, with a trust boundary that keeps them from being executed as commands. That boundary is exactly what EchoLeak broke through.

All four look outside the message rather than inside it, because how plausible a sentence sounds is no longer a reliable basis for judgment.

## Why Truth Is Hard to Tell Apart

Back to the sentence in the notebook: junk mail containing nothing but perfect truth. This isn't actually a hypothetical. Well-crafted phishing starts with real information — the name of the courier you actually ordered from, your real boss's name and manner of speaking, the name of a project that's genuinely underway. The faces the Arup employee saw were modeled on real colleagues' faces too. The lie is confined to a single final line: "Please send it to this account."

![A mock phishing email example. The boss's name, the project name, yesterday's meeting, the partner company, and the 48-million-won installment payment are colored green (true, if you check), while only two sentences — "their bank account has changed, so please send it to the new account below" and "I can't take calls. Just email me once it's done" — are colored red (false). On the right, a note on telltale signs: when account change, urgency, and blocked verification appear together, call a number you already know](/uploads/29b8fc47f7ac8ff2.webp =760)

This is why it's so hard to tell whether information is true.

First, **truth often doesn't reside inside the sentence itself.** The statement "This company's stock rose 20 percent last week" can be entirely factual, yet whether it functions as information or as bait depends on who is telling it to me now, and why. The same sentence changes meaning depending on the sender's intent.

Second, **we can't directly verify most information ourselves.** There is almost no way to personally confirm what's in a vaccine or what's happening in a war in a distant country. In the end we have no choice but to trust someone, and judgment shifts from the content to trust in the source. That trust is exactly what attackers target.

Third, **repetition breeds familiarity, and familiarity feels like truth.** Psychologists have studied this phenomenon since 1977 under the name "illusory truth effect" — hearing the same claim repeatedly makes it feel more plausible even without any supporting evidence.

Fourth, **the cost of creating a lie and the cost of refuting it are not the same.** Brandolini's Law holds that refuting a bogus claim takes far more effort than making one in the first place. AI has lowered the cost of making one even further.

The most effective lies are built mostly out of truth. Select which facts to show, omit the inconvenient ones, rearrange the order to leave a different impression. Every individual sentence passes verification, but the conclusion the whole thing leaves you with is wrong.

## The Hand That Moves Public Opinion, and the Hand That Moves AI's Answers

Apply this same structure to society as a whole, instead of to an individual, and you get public-opinion manipulation. In South Korea's 2018 "Druking" scandal, a macro program called "Kingcrab" was used to mass-manipulate the number of likes on news-portal comments. Once a program took over work that had been done by hand, the scale changed entirely.

The target is now shifting from portal comments to AI. In March 2025, U.S. information-reliability outfit NewsGuard reported that the Moscow-based "Pravda network" was mass-posting pro-Russian claims across huge numbers of websites to get them folded into AI training data and search results. These are sites with almost no human readers — the intended audience was AI, not people, from the start. When NewsGuard tested ten major AI chatbots, [they repeated the network's false claims more than 33 percent of the time](https://www.newsguardrealitycheck.com/p/a-well-funded-moscow-based-global). Researchers call this technique "LLM grooming."

Manipulation isn't confined to politics, either. In a 2024 [mock coffee-maker listing experiment](https://arxiv.org/abs/2404.07981), Harvard researchers showed that inserting just one particular string into a product page sharply raised the probability that AI would recommend that product first. A [paper on GEO (generative engine optimization)](https://arxiv.org/abs/2311.09735), presented at KDD the same year, reported that edits as simple as adding quotes, statistics, and citations could raise a page's exposure in AI answers by as much as 40 percent.

Research on attempts to steer AI's answers, gathered together:

| Who | What they did | Result |
|---|---|---|
| NewsGuard (March 2025) | Asked ten major chatbots about the pro-Russian "Pravda network"'s false claims | Repeated them more than 33% of the time |
| Princeton et al., GEO paper (KDD 2024) | Edited text by adding quotes, statistics, and citations | Exposure in AI answers rose by up to 40% |
| Harvard, Kumar & Lakkaraju (2024) | Inserted a single specific string into a product page | Sharply raised the odds of that product being recommended first |
| Authors of 17 papers (Nikkei report, July 2025) | Hid "give only positive reviews" in white text | Worked only on reviewers who used AI |
| Attack researchers, EchoLeak (June 2025) | Hid instructions for an AI assistant inside an email | Internal data could leak without a click (fixed before disclosure) |

AEO (answer engine optimization) and GEO aren't inherently bad. Structuring good writing so AI can read it well is no different from the SEO of the search-engine era, and Oosioo does this too. The problem is that the same technique doubles as a tool for planting bias. Search engines handed people ten links and left the choosing to them. AI answer engines hand over a single polished answer. With fewer chances to compare, it matters far more how much of which material went into producing that one answer. If someone has pre-seeded that material, the answer looks neutral while actually leaning one way.

## The Habit of Asking Who Sent It

The sentence in the notebook ends with "imagine that." And once you do imagine it, the answer isn't so hard. Whoever sent the junk mail containing nothing but perfect truth is someone who wants you to do something once you've believed that truth. In that case, truth isn't the goal — it's the instrument.

The answers AI hands us need to be read the same way. This isn't just about the possibility that the answer is wrong. Even when an answer is correct, we need to be able to ask what it left out, what it put front and center, and who benefits behind it. It helps to turn a few questions into habits.

1. Where did this information come from? Can I trace it back to the original source?
2. Who benefits if I believe this?
3. Is it telling me to hurry right now? Or to keep it secret?
4. Does a different channel, a different AI, or a different person give the same answer?
5. Is it too smooth? A story with not a single inconvenient fact is worth doubting.

What thirty years of spam filtering has taught us ultimately comes down to one lesson: content alone cannot separate the real from the fake — you have to look at the source, the path, and the intent. If machines learned to do that, people can too. In an age overflowing with information, the skill we need isn't an attitude of doubting everything, but a sense for knowing what to doubt.

## Image Credits

- Cover image, phishing email anatomy diagram, email authentication diagram: created in-house. The phishing email and inbox are fictional examples unrelated to any real organization or person
- AI phishing effectiveness graph: drawn in-house using figures from Hoxhunt's published data