Spoofing

Spoofing is when an attacker fakes a sender address so that a message, a caller, or a website appears to come from a person or company you already trust.

Key concepts

• Display names are trivial to fake. Check the full address hiding behind the friendly name before you act.
• Look-alike domains swap, add, or drop a single character. Read web and email addresses slowly, character by character.
• Caller ID can be faked as easily as email. A familiar number on your screen is weak proof of identity.
• Hover over links before you click them. For banking, payroll, and vendor portals, type the address yourself instead.
• Email authentication such as SPF, DKIM, and DMARC helps mail systems reject forged senders. Configure it for your own domain.

How sender spoofing works and how to stop it

Sender spoofing exploits the Simple Mail Transfer Protocol (SMTP), which lets a mail server send messages with any From address. A spoofed email can therefore carry your domain while leaving from an attacker's IP address. The email headers show the real path, and most phishing attacks rely on nobody reading them.

Email spoofing is a technique that forges the From address so attackers can send emails that look internal. SPF, DKIM, and DMARC let receiving servers check outgoing email from your domain. Email messages that fail those checks can be rejected or sent to quarantine.

Sender Policy Framework (SPF) lists the mail servers allowed to send for your domain. DomainKeys Identified Mail (DKIM) signs each message so tampering is detectable. Domain-based Message Authentication, Reporting, and Conformance (DMARC) tells receiving systems to quarantine or reject mail that fails both checks.

Publish all three email authentication protocols for every domain you own, including domains that send no mail. Train staff to report suspicious emails instead of replying, and route the reports to whoever runs email security. Review DMARC reports monthly to catch new abuse of your name.

Why it matters for your business

Spoofing is the setup for payment fraud, credential theft, and invoice scams that hit finance and leadership hardest. Technical controls and the human habit of checking addresses have to work together, because neither one catches everything on its own. You also need someone watching for the attempts that get through, and a plan to respond fast, which is where managed cybersecurity services earn their keep for a small security team.