Anyone can type almost any address into the From field of an email. Here is how spoofing works, why display names can pass every security check, and what you can do about it.
TL;DR
- Email spoofing forges the From address you see, while the true sending path stays hidden in headers recipients never check.
- Email’s original protocol had no sender verification, so any server can claim any domain unless protections like SPF, DKIM and DMARC are in place.
- Display name spoofing passes SPF, DKIM and DMARC because it uses a real sending account and only changes the label your inbox shows.
- The FTC reported email was the top method scammers used to contact people in 2024, often with fake invoices or urgent payment problems.
- Check the full sender address, not the display name, and contact companies through a phone number or website you already trust.
The name at the top of an email is a claim, not a proof. Anyone with a mail server can type almost any address into the From field. That trick, called email spoofing, makes a fake message look like it came from your bank or your boss. Knowing how it works helps you spot the fakes.
What Does Spoofing Actually Change About an Email?
Every email carries two sender addresses, and the gap between them is what spoofing exploits. The envelope sender, reflected in the Return-Path header, routes the message and handles bounces; recipients never see it. The From address is the one your inbox displays, just a line of text the sending server never has to prove.
A spoofed message keeps its true sending path. The attacker rewrites the From line, so mail from an unrelated server can display an address at your bank. The trick has been around since the 1970s, when spammers first used forged addresses to get around filters.
Why Was the From Field Never Built to Be Verified?
Email’s founding protocol, SMTP, was designed without sender verification. By default, no check confirms that a sending system is authorized to use the From address it declares, so any server can claim to send for any domain.
The problem became more common in the 1990s and a global cybersecurity issue by the 2000s. Authentication standards introduced in 2014 began to close the gap, and many spoofed messages now land in spam folders or get rejected. They have not been eliminated, and not every email service runs the checks.
How Do Display Names, Lookalike Domains and Reply-To Tricks Fool You?
Most people never read a full email address. Mail programs show the display name and often hide the address. Attackers count on that. They set the display name to match a bank, an executive or an IT administrator, then send from an account they control, often a free webmail account or a throwaway domain. A glance at the name is all they need.
Display name spoofing is the simplest and most common form of sender impersonation used in business email compromise, and it slips past authentication entirely, for a reason covered below.
Two other tricks travel with it. Lookalike domains mimic a real one, so microsoft.com might become M1crosoft.com. The Reply-To header can also point replies to a different address, so your answer lands in the attacker’s inbox.
How Do Authentication Checks Try to Catch Fakes?
Three main checks fight back. SPF asks whether the server that sent the message is authorized to send for the domain in the envelope sender. DKIM attaches a cryptographic signature and validates that the message was not altered in transit. DMARC ties the two together and checks that they align with the domain shown in the From field.
Here is an illustration. A message displays ‘Acme Billing billing@acme.com.’ Your server checks Acme’s SPF record, verifies the DKIM signature and finds the domains align. The message passes. If the message instead came from a random server claiming that address, SPF fails, DMARC flags the mismatch and the message goes to spam or gets rejected.
The catch is that none of these checks read the display name. A message from a real free email account wearing the display name ‘John Smith, CEO’ passes all three checks for that account’s domain. The authentication is honest. The label is not.
Tip
Authentication checks the domain that actually sent a message, not the name your inbox shows. A passing check is not proof the sender is who the name claims.
If you own a domain, publish SPF, DKIM and DMARC records so servers can tell your real mail from fakes wearing your name. If you still send business mail from a free address, read why your business should use its own email domain, then lock down your email account with stronger sign-in protections.
How Does Spoofing Feed Phishing and Business Email Compromise?
Spoofing is the disguise. Phishing is the scam carried out in it. The FTC reports that email was the top method scammers used to contact people in 2024, and a forged sender raises the odds you click.
The stories follow a pattern. An unexpected message that looks like your bank or utility company says your account is on hold and invites you to click a link to update payment details. Or it carries an invoice you do not recognize or promises a government refund. Legitimate companies will not email you a link to update payment information.
At work, the same technique becomes business email compromise, where an attacker impersonates an executive or vendor to push an urgent payment or a request for sensitive data. Our guide to what business email compromise is and how to stop it covers the playbook, and how to spot a phishing email before you click walks through the warning signs.
How Do You Tell a Spoof From a Real Message?
Start with the full address, not the name. Hover over or tap the sender to reveal it. If the name says your bank but the address ends somewhere unexpected, be suspicious. Then ask a few questions. Does the message arrive unexpectedly and push urgency? Does it use a generic greeting? Does it ask you to click a link to fix a payment problem? Scammers can learn real details about you, so a sender who knows your address proves nothing.
If doubt remains, do not click or reply. Contact the company using a phone number or website you know is real, forward suspected phishing to the Anti-Phishing Working Group at reportphishing@apwg.org, and report it to the FTC at ReportFraud.ftc.gov.
When the next odd message arrives, check the full sender address first.
Quick answers
Q: Can someone spoof my email address without hacking my account?
A: Yes. Display name spoofing puts your name on messages sent from a different address, so your account can stay completely secure. If contacts keep reporting mail that looks like it came from you, it is still worth checking your account for signs of a real compromise.
Q: Do SPF, DKIM and DMARC stop all spoofing?
A: No. They catch forged domains well, but they do not check the display name. An attacker using a real account with a familiar label can still get through.
Q: What should I do if I replied to a spoofed email?
A: Change your password if you entered one, contact your bank if you shared financial details, and report the message to the Anti-Phishing Working Group and the FTC. If you only replied without sharing anything, watch for follow-up scams.
Q: Why does spoofing still work after all these years?
A: The original email protocol never verified senders, and the fixes added later are optional. Not every service runs the checks, and the display name remains outside their reach.
Email services change their settings and menus often. This guide is general information, not legal or professional security advice; check your provider’s help pages and official sources such as FTC.gov and CISA.gov.
