Email spoofing

Forging the sender details of an email so it appears to come from a trusted person, company or domain when it actually comes from someone else.

Email was not originally designed to verify who sent a message, so it is possible to put almost any name or address in the From field. Spoofing ranges from simply changing the display name to an executive's name, to sending mail that appears to come from your exact domain, to using look-alike domains that differ by a single character.

Spoofing is the foundation of many phishing and business email compromise scams. An Alberta business may find criminals sending fake invoices to its clients using its name, or staff may receive a message that seems to come from the owner asking for gift cards or an urgent transfer. These attacks can cause direct financial loss and damage your reputation with customers.

Practical tip: set up SPF, DKIM and DMARC for your domain to make exact-domain spoofing much harder, and enable external sender warnings in your email system. Train staff to check the actual email address, not just the display name, and to verify unusual requests through a separate channel.