What is the Anti-Phishing Working Group (APWG)?

If your brand's name has ever been used in a phishing email you didn't send, you've already felt the problem that the Anti-Phishing Working Group (APWG) exists to fight. APWG is an international coalition dedicated to tracking, researching, and reducing phishing and email fraud. It brings together financial institutions, technology companies, law enforcement, and government agencies to share threat intelligence and coordinate responses when phishing campaigns hit.

APWG maintains the eCrime Research database, which tracks phishing attacks globally. They publish regular trend reports covering which techniques attackers are using, which brands are being spoofed most often, and how the tactics are evolving. If you want to understand the threat landscape rather than just react to it, their public reports are worth reading.

For email senders, APWG's work matters more than it might seem at first. Phishing attacks that spoof your brand erode the trust your subscribers have in your emails, even when you've done nothing wrong. The damage is real and it can show up as lower open rates, increased spam reports, and recipients who start second-guessing whether anything from your domain is safe to click.

APWG also does something spam filters don't. Spam filters catch bad mail at the inbox level. APWG coordinates upstream, working with hosting providers, registrars, and law enforcement to take down phishing infrastructure before it reaches anyone's inbox. That's a different layer of defense entirely.

The practical implication for senders is that DMARC is your main tool here. A properly configured DMARC policy at reject or quarantine directly limits attackers' ability to spoof your domain in phishing emails. APWG's work shows you the size of the problem. DMARC is how you close the door on your end.