The Invisible Character in the Middle of "Funding"

For years the advice about spotting a scam has been about looking harder. Check the spelling. Check the greeting. Check the sender. All of it assumes the same thing: that if something is wrong with a message, it is wrong somewhere you can see.

Last week Microsoft published research on a campaign built specifically to break that assumption.

What happened

From February 9 into the middle of May, a phishing operation pushed finance bait at small businesses: funding offers, credit lines, cash advances, the SBA-lending-lookalike genre. On its biggest day, February 11, it moved past 2.3 million messages. It ran through a legitimate email marketing platform, from a stack of throwaway domains with names like guardiangrowthfunding, and for three months it kept landing in inboxes that should have filtered it.

The interesting part isn't the volume. It's the single trick that got it through.

How it actually works

A lot of email filtering comes down to reading. A rule looks at the text of a message and hunts for the words a particular pitch can't function without. For a fake lending offer, those words are funding, capital, loan, advance. Take them away and there's no pitch left. So the words are a reasonable thing to look for.

The senders didn't remove them. They broke them, in a way that only exists for the machine.

Unicode contains a block of "tag" characters, U+E0000 through U+E007F, that were designed for a purpose that never really took off and are defined to render as nothing at all. Not a space. Not a box. Not a question mark. Zero width, zero ink. Your screen has literally nothing to show you.

Put one between fun and ding and you get a word that reads as "funding" to every human being who looks at it, and reads as some string no rule was ever written for to everything else.

The technique already had a name before it showed up here. It's called ASCII smuggling, and it got attention in AI security, where researchers used the same invisible characters to bury instructions inside text that an AI assistant would obediently read and a person reviewing that text would never see. Microsoft's writeup, by researchers Noam Kochavi and Sarah Wolstencroft, is essentially a note that the trick has changed careers. Same mechanism, ordinary crime.

What it means for the rest of us

The useful lesson here is narrower than "scams are getting smarter," and more actionable.

This is a defeat for anything that makes a decision by reading. That's a big family: spam filters, keyword alerts, content rules, and increasingly, any AI assistant you let near your inbox. All of them share the assumption that the text they're parsing is the text you're seeing. That assumption is now cheap to break.

And it fails quietly, which is the part worth sitting with. When a filter misses a well-written scam, you can go back and see what fooled it. Here there's nothing to look at. Nothing looks wrong with these emails because nothing is wrong with them, on your end. The entire engineering effort went into making them normal.

What to actually do

Stop treating your inbox as a verdict. A message arriving means it wasn't caught. It does not mean it was cleared. This whole campaign is a three-month demonstration of the difference.

Move money decisions off the text. If a message wants you to act on funding, an invoice, a payment change, or an account problem, settle it somewhere that isn't the message: a number you already had, a site you typed in yourself, a person you can walk over to. No amount of invisible cleverness in an email survives you making a call it doesn't control.

If you write any rules, normalize before you match. This is Microsoft's own recommendation and it's the whole fix: strip Unicode tag characters out of text before keyword, signature, or regex rules run on it. Do the same before email gets fed to an AI assistant, which closes the prompt-injection version of the same hole. It's a small change, and three months of this campaign depended on nobody making it.

Where SAFE Portal fits

The straight answer first: we are not your spam filter. If your provider's rules get smuggled past, that email lands in your inbox, and we never saw it. We don't scan message text, and we're not going to pretend this is a problem we solve.

What we'd point out is that the trick has nothing left to work on after that.

The filters that invisible text defeats are the ones doing the reading. Ours is doing the addressing.

That's not a claim to have solved phishing. The email still arrives, and we didn't catch it.

What we won't concede is the part that usually comes next, where a person inevitably gets talked into typing their password anyway. That moment has a layer of its own. Password fields and downloads are both judged safe, unsure, or dangerous, and the judgment comes off your SAFElist and SAFEwall. The same address-based machinery as everything else here. Still nothing reading the message.

On a page you've never verified, that means the password field doesn't quietly accept whatever you type into it. It stops and asks whether this is somewhere you actually meant to trust, and you either add it to your SAFElist or you don't. Which lands in precisely the right spot: after the email got through, after the link looked convincing, at the moment it would otherwise start costing you something.

Turned up to its strictest, it stops asking and blocks outright. That setting is built for advisor and advisee accounts, where the person holding the judgment call isn't the person sitting at the machine.

Which is the same principle running underneath all of it. The question is never "does this message look suspicious." It's "is this somewhere I already trust." The first question can be beaten with a character you can't see. The second one has nothing to read.

Nothing looked wrong with those emails. That was the entire point.

SAFE Portal is a password manager and link screener built for people who'd rather not have to be experts. It's $1 a month, $5 for a family, and free to try at SAFEPortal.to.