Email spoofing
Email spoofing
(also email spoofing attack, email spoof)
Email spoofing definition
Email spoofing is a type of cyberattack where the criminal fakes (spoofs) the sender address of an email message to lull the receiver into a false sense of security. By getting the victim to lower their guard, the attacker hopes to trick them into clicking a link to a malicious website or downloading an infected attachment.
Email spoofing is a form of social engineering. Typically, attackers pose as people in positions of authority (like bank or government agents) or acquaintances of the victim. While it is possible to outright forge an email address in some cases, most email spoofs are sent from devices hijacked by malware.
Real email spoofing examples
- Emails from friends asking you to download a hilarious meme picture. In reality, the attachment harbors a virus that adds your device to the email spoofing botnet and secretly uses it for further attacks.
- Emails from your ISP asking you to click a link that will take you to a personal offer on their website. The link instead takes you to a fake website that attempts to run malicious scripts in the background.
Stopping email spoofing
- Verify links and attachments before you click — if possible, contact the purported sender through other means and ask if they really sent the message.
- Always check the sender’s email address for mistakes. Social engineering attacks rely on carelessness and wilful lack of awareness.
- Use dedicated antivirus software and update it regularly. Infected devices may be used for email spoofing attacks without the owners’ knowledge.
- Use a strong password to prevent hackers from taking over your account and using it for email spoofing attacks.