CyberGlossary

Attacks & Threats

Email Spoofing

Also known as: Sender spoofing, From-header spoofing

Definition

Forging email headers so a message appears to come from a trusted sender, typically to enable phishing, fraud, or malware delivery.

Email spoofing exploits the fact that SMTP does not natively authenticate the sender. Attackers manipulate the visible From header, the envelope MAIL FROM, the display name, or use look-alike domains and Unicode homographs to impersonate executives, brands, or business partners. Spoofing is the foundation of phishing, business email compromise, and invoice fraud. Defences are primarily protocol-based: SPF, DKIM, and a strict DMARC policy with reject/quarantine alignment, plus inbound anti-spoofing checks, display-name lookups, banner labels for external mail, and verified-sender programs such as BIMI.

Examples

  • An email with a forged From: ceo@company.com asking finance for an urgent wire transfer.
  • A vendor look-alike domain (acme-corp.co instead of acme.com) sending fake invoices.

Related terms