Abstract

One of the most critical cyber-threats is phishing emails, which are ever-growing and increasingly sophisticated, evading classical detection systems through changes in language, structure and relations within content. Machine learning techniques have classical grounds, fast inference, interpretable and engineered features, and economic advantages, but they tend to be unable to adjust to new, situationally-rich attacks. Recent advancements in deep learning — including CNN, hybrid, and LSTM models — can automatically extract trends from unprocessed mail information, substantially advancing detection accuracy despite the challenge involved. Transformer-based models, particularly BERT-based algorithms, further enhance contextual and semantic understanding, achieving state-of-the-art performance, though at the cost of increased computational demand. Recently added URL- and metadata-based detection methods add lightweight, scalable defenses for use in multimodal frameworks. This is a critical appraisal reviewing the shift from Classical ML to Deep and Transformer-based approaches, examining the trade-offs in accuracy, efficiency, readability and computational power. A comparative synthesis indicates the most significant contributions, strengths and limitations of each approach. Key research gaps identified include: sustained resistance to attacker strategies, hybridization to strengthen detection of new phishing forms, and explainable, user-friendly detection systems. This paper provides critical insights into existing challenges and indicates additional directions of investigation needed to achieve good, scalable and flexible phishing e-mail detection in dynamic cyber environments.