Email spoofing is an attack where hackers make it appear that an email originates from a different address than it does. Spoofing allows the attacker to impersonate people or organizations for various reasons. That’s scary, so how does it work?
Why Email Spoofing Happens
Email spoofing is a form of impersonation, and usually, it forms part of a different type of scam or attack. Spoofing plays a major role in email-based phishing or so-called 419 scams. An email arrives in your mailbox purporting to be from your bank, an online payment processor, or in the case of spear phishing, someone you know personally.
The email often contains a link you’re asked to click, which takes you to a fake version of a real site where your username and password are harvested.
In the case of CEO fraud, or where attackers impersonate vendors or business partners, the emails ask for sensitive information or request bank transfers to accounts the hackers control.
How Spoofing Works
Email spoofing is surprisingly easy to do. It works by modifying the email “header,” a collection of metadata about the email. The information you see in your mail app is pulled from the email header.
The SMTP (Simple Mail Transport Protocol) doesn’t make any provision to authenticate email addresses. So hackers take advantage of this weakness to fool unsuspecting victims into thinking the mail is coming from someone else.
This is a different form of email impersonation, where the email address is designed to resemble the real address of the impersonation target. In that case, the attacker creates a separate email on the same domain and uses methods such as switching letters or numbers that look similar to each other in the fake address.
The FROM, REPLY-TO, and RETURN-PATH sections of an email header can be modified without any special tools or advanced knowledge. This will result in an email that, on the surface, shows you a forged origin address.
Detecting Email Spoofing
The easiest way to detect a spoofed email is to open the email’s header and check whether the header’s IP address or URL under the “Received” section is from the source you expect it to be.
The method to see an email’s header varies from one mail app to the next, so you’ll have to look up the exact method for your email client. Here we’ll use Gmail as an example since it’s both popular and easy to do.
Open the email you suspect is spoofed, click on the three dots, and “Show Original”.
Next to “Received” you’ll see a server URL and also an IP address. In this case, an email supposedly from Costco is coming from a server that doesn’t seem to be from Costco.
To confirm this, copy the IP address and paste it into DomainTools’s WhoIs Lookup.
As the results show, this IP address originates from Singapore and comes from a Microsoft domain.
It’s highly unlikely it’s really from Costco, so this is probably a scam email!
How to Combat Spoofing
While checking the email header of a message for suspicious content is a reliable way to confirm that an email has been spoofed, you need to be mildly technical to understand what you’re looking at, so it’s not the most effective way to help people in your company or home avoid becoming a victim.
It’s much more effective to apply a few basic rules when it comes to any unsolicited email that asks you to click on a link, transfer money, or asks for privileged information:
- Double-check any requests for money transfers using another channel, such as a phone call.
- Don’t transfer money into accounts that aren’t approved.
- Don’t click on links inside emails that you have not requested.
- Type any web addresses into your browser yourself.
Most importantly, always verify high-risk messages with the sender using a separate channel such as a phone call or secure chat. (Don’t use any phone numbers provided in the email, however.) A 30-second conversation can 100% confirm whether you’re the victim of spoofing or not!
RELATED: How to Spot a Fraudulent Website
