Spoofing

Spoofing is when an attacker fakes a sender address so that a message, a caller, or a website appears to come from a person or company you already trust.

Key concepts

• Display names are trivial to fake. Check the full address hiding behind the friendly name before you act.
• Look-alike domains swap, add, or drop a single character. Read web and email addresses slowly, character by character.
• Caller ID can be faked as easily as email. A familiar number on your screen is weak proof of identity.
• Hover over links before you click them. For banking, payroll, and vendor portals, type the address yourself instead.
• Email authentication such as SPF, DKIM, and DMARC helps mail systems reject forged senders. Configure it for your own domain.

Why it matters for your business

Spoofing is the setup for payment fraud, credential theft, and invoice scams that hit finance and leadership hardest. Technical controls and the human habit of checking addresses have to work together, because neither one catches everything on its own. You also need someone watching for the attempts that get through, and a plan to respond fast, which is where managed cybersecurity services earn their keep for a small security team.