What Is Email Spoofing and How Does It Work?

Email spoofing is a type of cyber threat where a cybercriminal sends emails to potential victims using fake sender addresses. Email spoofing works by forging a sender address to make it seem as though it’s coming from a legitimate person or company. Email spoofing is a tactic typically used by cybercriminals when carrying out phishing attacks to encourage their targeted victim to send them sensitive information. 

Continue reading to learn more about how email spoofing works, how it differs from phishing and how to identify spoofed emails. 

How Does Email Spoofing Work?

To understand how email spoofing works, you have to understand what an email consists of. An email is made up of three main parts: the envelope, a header and the body. Cybercriminals can manipulate each of these parts to make the email appear as though it’s coming from someone else. 

• Envelope: The envelope of an email is what tells the email server who sent the email and who is supposed to receive it. When you receive an email in your inbox, you don’t see the envelope.
• Header: The header of an email is the data that you do see when you receive an email. This includes data such as the sender’s name and email address, the email subject, the reply-to address and the email send date. 
• Body: The body of an email is the content itself. The body of the email conveys the overall message and is the main reason why the email was sent to you. 

When a cybercriminal sends out a spoofed email, they customize each of these parts to make it look like the email is coming from a particular person or company. When the spoofed email makes it to the victim’s inbox, the email service scans the contents of it and generates what the victim sees when they read the spoofed email. Email spoofing is typically done by a cybercriminal forging the envelope and header parts of the email to make it seem as though a different sender sent it. 

Email Spoofing vs Phishing: What’s the Difference?

The main difference between email spoofing and phishing is that email spoofing is a technique used to disguise a cybercriminal’s email address, whereas phishing is an attempt to get a potential victim to reveal sensitive information. 

While email spoofing and phishing aren’t the same, email spoofing can be leveraged to carry out phishing attacks. By spoofing an email, cybercriminals can make themselves look as though they are trustworthy, making potential victims more inclined to provide them with sensitive information or click on malicious links and attachments. 

4 Tips To Help You Identify Spoofed Emails

Here are four tips to help you identify spoofed emails. 

Listen to email-provided warnings

Most email service providers will give warnings about emails that they believe aren’t legitimate. Email servers can verify the authenticity of an email by checking if incoming emails have failed authentication processes like the following:

• Sender Policy Framework (SPF): SPF is a method used for email authentication that helps identify which mail servers are allowed to send emails from a specified domain, based on the sender’s IP address. 
• DomainKeys Identified Mail (DKIM): DKIM is another method used for email authentication where a digital signature lets the email receiver know that the message was sent and authorized by the owner of the domain that was used. 
• Domain-based Message Authentication, Reporting and Conformance (DMARC): DMARC is a policy that lets an email server know what to do based on the results after checking SPF and DKIM. Depending on how the DMARC policy is configured, it will either quarantine an email, reject it or deliver it to the recipient’s inbox. 

If you receive an email, but it warns you about the sender or contents of the email, it’s best to avoid interacting with it. 

Check the email’s security protocols

If you don’t receive an email-provided warning and believe an email sent to you may be spoofed, you can check the security protocols yourself. Here’s how. 

1. Open the email you want to check on a computer
2. Click on the three vertical dots in the upper right-hand corner of the email
3. Click where it says “Show original” or “Show details”
4. Check the SPF, DKIM and DMARC. If the email is not spoofed, each of these protocols should say “PASS.” If the email is spoofed, one or all of these protocols will say “FAIL.”

It’s important to note that domain owners have to set up SPF, DKIM and DMARC records to prevent cybercriminals from being able to send spoofed emails using their domain name. If a domain owner fails to have these security protocols set up, spoofed emails may come up as “PASS.” 

Check the email’s “reply-to” email address

When you are replying to an email, the email address that displays when you click “reply” should be the same email address that you received the email from. If the email address is not the same, the email is likely spoofed, and you should avoid replying and interacting with any of the contents in the email. 

Be wary of emails that display a sense of urgency

Emails from cybercriminals always display a sense of urgency so you act quickly without thinking or second-guessing yourself. These emails may urge you to quickly send them your personal information or click a link, but doing this can result in your data being compromised or your device becoming infected with malware. Malware is malicious software that can be used to gather information about you to use for identity theft or other malicious purposes. 

If you notice an email urging you to do something quickly, it’s possible that it’s a scam to get you to reveal sensitive information. 

How To Stay Protected Against Email Spoofing

You can stay protected against email spoofing by not clicking dangerous links or attachments in emails, not sharing personal information and using antivirus software. 

Avoid clicking links and attachments in emails

The best way to stay protected from email spoofing and other email scams is to avoid clicking on any links or attachments you’re sent through email, especially if you weren’t expecting them. If you receive an email that looks like it’s from a company you have an account with, don’t just blindly click links or attachments they have sent you; instead, navigate to their official website and continue from there. 

Don’t share personal information through email

If you’re being asked to share sensitive information through email and you were not the one who initiated contact with the individual, company or organization asking you for it, don’t share any of your information. This could be a cybercriminal trying to get you to reveal information so they can use it to get into your online accounts, steal money and possibly steal your identity.

Use antivirus software

Antivirus software is a program you can install on any of your devices that detects and removes known malware and viruses before they can cause an infection. Some spoofed emails aim to infect your devices with malware so that cybercriminals can gather as much sensitive information as they can from your devices. 

Having antivirus software already installed on your device can alert you if the contents of an email contain malware. Some antivirus will even prevent an email containing malware from making its way into your inbox in the first place. 

Keep an Eye Out for Spoofed Emails

Spoofed emails can be hard to detect if you don’t know what they are or how to identify them. By following the tips above, you can better protect yourself and your sensitive data from getting into the hands of cybercriminals. 

In addition to knowing how to spot spoofed emails, it’s also important to learn how to protect your email accounts from compromise. Learn how to make your email more secure by following a few of our tips.