Spoofing

What it means

Spoofing is faking a sender's identity, such as an e-mail address, a phone number, a name in a message or a website, so that the victim believes they are dealing with a trusted party. The attacker poses as a bank, a supplier, an authority or the company's own management.

It underlies most fraud in cyberspace. Without a convincing fake identity, neither phishing nor business email compromise would work, because the recipient would simply ignore a message from an unknown sender.

Spoofing comes in several forms. E-mail spoofing alters the displayed sender address, caller ID spoofing fakes the calling number, domain spoofing uses near-identical web addresses with a typo, and advanced attacks add a forged voice or image created with deepfake technology.

How it works in practice

For companies the key step is protecting their own domain technically by setting up SPF, DKIM and DMARC. These records let recipients' mail servers recognise that a message carrying your address did not actually come from your servers and reject it or flag it as suspicious.

In accounting and finance, spoofing most often appears as a fake request to change a supplier's bank account or an urgent instruction from a supposed director to pay immediately. An effective defence is a rule to verify every such change by calling a known number, never the number given in the message.

Regular security awareness training teaches staff to notice small differences in addresses, an unusual tone or pressure to act fast. It is just as important that they are not afraid to report a suspicious message, even if it later turns out to be genuine.

What to watch out for

A displayed sender name and caller ID are very easy to change, so on their own they prove nothing. With phone contact, vishing and smishing must also be expected, where the attacker calls or sends text messages from a spoofed bank or courier number.

If a company falls for the fraud and sends a payment, speed is decisive. It should contact its bank immediately to stop or recall the payment, file a criminal complaint and check whether data was also leaked, which may require notifying the supervisory authority.