Email spoofing forges the visible sender address so a message appears to come from a trusted person or brand it does not.
The forgery abuses trust in the name on the message, which is different from stealing the mailbox password and sending as the real account.
How it works
Receivers may see a familiar name while the message was injected by someone who does not control that mailbox.
Payment requests, password reset stories, and urgent executive notes are common harms, and the defense is both technical authentication and a human pause.
SPF, DKIM, and DMARC help other providers decide whether mail really comes from the domain it claims.
Those controls do not replace a second channel when money or access is at stake, because some lookalike domains pass checks for a name the victim did not inspect closely.
Concrete examples
- A finance clerk receives a transfer request that displays the chief executive's name but fails the domain's authentication checks.
- Customers get a shipping notice from a lookalike domain that passes casual reading and fails a closer look at the address.
- A partner's real domain publishes a reject policy, and forged copies of that domain start bouncing at other providers.
Protective measures
- Publish sender authentication that tells other providers to reject mail you did not send.
- Mark external mail clearly so a forged internal name is harder to mistake for a colleague.
- Confirm payment and access requests through a channel you already know, even if the display name is familiar.
- Teach staff to read the actual address, not only the display name, before they act on urgency.