Spoofing

Spoofing is when an attacker disguises a communication or device to appear as if it comes from a trusted source, such as a familiar email address, phone number or website.

Spoofing comes in many forms. Email spoofing forges the sender address. Caller ID spoofing makes a phone call look like it is from your bank or a government office. Website spoofing uses look-alike domain names, such as swapping a letter or using a different ending, to imitate a real site. There are also technical forms that target network traffic.

Spoofing makes scams far more convincing. A client who receives an email that appears to come from your business, asking them to pay an invoice into a new account, may not think twice. That can harm your reputation and relationships even though your own systems were never breached.

Practical tip: protect your domain with SPF, DKIM and DMARC records, and consider registering common misspellings of your domain name. Tell clients and suppliers clearly that you will never change banking details by email alone, and remind staff that caller ID and display names can be faked.