Detecting phishing and spam with AI in n8n: beyond the classic filter

A classic spam filter blocks poorly written mass campaigns, full of typos and crudely malicious links, very well. It is far more helpless against targeted phishing that reads flawlessly, mimics the tone of a regular supplier, and contains no link to an already-blacklisted domain. That is exactly the category of threat that has grown since large language models arrived — capable of generating an undetectable spear-phishing email on demand. The good news: the same kind of model can also spot these emails, provided it is wired correctly into an n8n pipeline.

Why static rules aren't enough anymore

A Bayesian filter or a domain blocklist works by pattern recognition on things already seen: suspicious keywords, sender reputation, the typical HTML structure of a known campaign. That mechanism has two structural blind spots:

• Novel, well-written content: an email generated by an LLM has no spelling mistakes and no awkward phrasing, the two most reliable signals traditional filters rely on.
• Contextual inconsistency: a sender domain that closely mimics the real one (support@paypa1.com), a wire-transfer request that contradicts a supplier's known habits, an artificial sense of urgency — all signals an LLM can analyze the way an attentive human would, but that a static rule doesn't capture.

A study by Koide, Fukushi, Nakano, and Chiba, ChatSpamDetector: Leveraging Large Language Models for Effective Phishing Email Detection (2024, see on Google Scholar), tested a GPT-4-based pipeline on a large set of real emails: the detection rate reached 99.70%, well above the commercial filters compared in the study, with one more decisive advantage — the model produces a natural-language explanation of its verdict, usable directly in a Slack alert or a daily digest, rather than an opaque score alone.

The architecture: AI alongside technical checks, not instead of them

The most robust pipeline doesn't replace existing technical checks — it combines them with a semantic analysis layer. Three steps in n8n.

1. IMAP trigger and technical signal extraction

The entry point is the same as for any AI-driven email triage: an IMAP Email node or a webhook provided by your platform (Gmail, Outlook). Before even calling a model, a Code node extracts the cheap technical signals worth checking first:

• SPF, DKIM, and DMARC results, present in the email's raw headers (Authentication-Results);
• The sender's real domain compared to the displayed name;
• The presence of executable attachments or shortened links.

An SPF/DKIM/DMARC failure alone isn't enough to automatically conclude phishing (some legitimate senders are misconfigured), but it's a valuable input signal to pass along to the model rather than ignore.

2. The classification prompt

The AI Agent or Message a Model node receives the email body, sender, subject, and the technical signals extracted in the previous step, with a structured output instruction rather than free text:

You are an email security analyst. Analyze this email and determine whether
it is a phishing attempt.

Sender: {{ $json.from }}
SPF/DKIM/DMARC result: {{ $json.authResults }}
Subject: {{ $json.subject }}
Body: {{ $json.bodyText }}

Specifically look for:
- artificial urgency or a threat (suspended account, unpaid invoice)
- an unusual action request (wire transfer, credentials, an attachment to open)
- a mismatch between the displayed domain and the sender's real domain
- a tone that mimics a known supplier without matching its usual style

Respond only in this JSON format:
{
  "risk_score": <0-100>,
  "category": "phishing" | "spam" | "legitimate" | "uncertain",
  "reasoning": "<one-sentence explanation>",
  "signals": ["<list of detected signals>"]
}

The reasoning field is what turns a plain score into a usable tool: it's what shows up in the alert sent to the team, so a human understands in five seconds why the email was flagged, without having to read the whole thing.

3. Score-based routing: quarantine, alert, or normal flow

A Switch node then routes the email based on risk_score:

• High score (> 80): the email is moved to a quarantine folder (IMAP Move action) and an alert immediately goes out to Slack or Teams, with the model's reasoning in the message body.
• Mid-range score (40-80): the email stays in the inbox but gets a "needs review" label, visible to the user rather than hidden.
• Low score (< 40): the email follows the normal triage path, like the one described in our guide on classifying incoming documents.

The human-approval loop on ambiguous cases

An LLM that errs one way (letting a phishing email through) is dangerous; erring the other way (blocking a legitimate email from a client) costs trust and sometimes real business. For mid-range scores or high-impact actions (permanent blocking, alerting the whole team), the right practice remains human approval via a Wait node and a Slack button rather than an irreversible automatic action. The model proposes, a human validates in one click — the pipeline keeps its full speed on the 95% of unambiguous cases, and reserves human attention for the 5% that deserve it.

Controlling cost and latency

Having a capable model re-read every incoming email gets expensive at scale. Two levers, already documented elsewhere on this blog, apply directly here:

• A model cascade: an economical model (gpt-4o-mini) runs a first pass on 100% of the flow; only the emails it flags as ambiguous or suspicious get re-analyzed by a more capable model. The volume reaching the expensive model becomes marginal.
• Tracking real cost: wiring this workflow into the same AI call cost tracking mechanism as the rest of your automations avoids billing surprises at the end of the month, especially on a high-volume inbox.

On a flow of a few hundred emails a day, an economical model as the first pass keeps this pipeline's cost to a few euros a month — consistent with the rest of your AI email-triage workflows.

Going further

This phishing-detection pipeline layers naturally on top of an existing email triage setup: it shares the same IMAP trigger, the same structured scoring logic, and the same alert channel as the other workflows in the Inbox AI Pack (€79), which already includes AI triage, urgency prioritization, the daily digest, and Gmail reply drafts. If your needs go beyond the inbox alone and also cover a RAG documentation assistant or a compliance audit trail, the Complete FlowKit Bundle (€269 instead of €347) brings all three packs together on a shared foundation, with the same Error Workflow pattern and credential security practices running through every workflow.