How do images get scanned for text or phishing cues?

At some point, senders figured out that text hidden inside an image wouldn't trip text-based spam filters. It worked for a while. Spam filters caught on fast, and they now scan images directly using optical character recognition (OCR) and visual pattern matching. Whatever you'd catch in plain text, filters will catch in an image too.

OCR lets a filter read text embedded in an image the same way a human would. If your image contains phrases that would trigger a text-based spam filter, they get caught just the same. Filters are looking for what bad actors try to hide this way: urgency language, misleading pricing claims, counterfeit offers, and fake warnings. Encoding a "You've won!" banner in a JPEG stopped working years ago.

Visual pattern matching goes further. Filters maintain databases of known phishing layouts and brand logos from companies like PayPal, major banks, and delivery services, then check whether your images match known fraud templates. An email from an unknown sender containing a pixel-perfect replica of a login screen will score very high for phishing risk regardless of the surrounding text. Image metadata is checked too: unusual dimensions, signs of repeated re-encoding, and file names that match known phishing kits all add to the score.

For legitimate senders, the rules are simple. Don't rely on images as your only content, keep a healthy text-to-image ratio, and make sure every image has descriptive alt text so the email reads clearly when images are blocked. If you're running an image-heavy campaign, test it through a pre-send inbox testing tool before deploying so you can see exactly how filters score the content.