How attackers spoof an email address
Email spoofing is one of the most frequent types of cybercrimes. Spoofing an email address means that the sender is posing as someone else in an attempt to gain the trust of the recipient. Attackers frequently spoof an email address as the first step in a spear-phishing campaign or business email compromise attack. Spammers spoof email addresses to increase the chances that recipients will open an email and respond to it.
There are a number of ways that attacker can spoof an email address. Changing the display name – the name of the sender that is visible to recipients – may be the most common. Attackers use this method to pose as a trusted individual or a trusted brand while encouraging the recipient to take action that benefits the attacker. Attackers can also spoof an email address by using a legitimate email address in the "From" header, exploiting security holes in standard email protocols. Using look-alike domains is another way to spoof an address. With this method, attackers may substitute numbers or characters from other scripts like Cyrillic for letters in the email address, or create a new domain name that has only very subtle differences from an actual legitimate domain.
No matter how attackers spoof an email address, the results can be devastating. Email recipients may be duped into revealing sensitive information like credit card data or Social Security numbers. They may be tricked into revealing login credentials that give attackers access to corporate networks. Or they may even be fooled into wiring a money transfer to a fraudulent account.
Stopping email spoofing – as well as website spoofing, DNS spoofing and other forms of fraud – requires state-of-the-art anti-spoofing technology that can keep pace with the rapidly evolving and sophisticated attack methods. That's where Mimecast can help.
