← All terms

Spoofing

Spoofing is the falsification of an identity signal — sender address, caller ID, domain, or website — to make an attack appear to come from a trusted source.

Spoofing is the umbrella term for falsifying an identity signal so that a message, call, or website appears to come from someone the victim trusts. It is rarely an attack in itself; it is the credibility layer that makes phishing, vishing, and fraud convincing.

How it works

The common forms in social engineering:

  • Email spoofing. Forging the "From" header so a message appears to come from a colleague or brand. Where a domain lacks properly enforced SPF, DKIM, and DMARC records, mail claiming to be from it can pass through unchallenged.
  • Display-name spoofing. The simpler cousin: the sender address is attacker-controlled, but the display name reads "CEO Jane Smith" — enough on mobile clients, which often hide the real address.
  • Caller ID spoofing. VoIP services let attackers present any number, so a fraud call appears to come from the victim's bank, IT help desk, or a government agency.
  • Domain and website spoofing. Look-alike domains and cloned login pages, closely related to typosquatting, give the deception a destination that survives a quick glance. Where the redirection is pushed into DNS itself, so the correct address resolves to the attacker's server, it becomes pharming — spoofing without a link to click.

Layered together — a spoofed sender, a look-alike domain, a cloned portal — these signals defeat the shallow checks most people rely on, which is why spoofing features in the vast majority of successful phishing and business email compromise incidents.

How to defend against it

  • Enforce email authentication. Publish SPF and DKIM, and move DMARC to p=reject so exact-domain forgery of your own domain fails outright.
  • Train verification habits, not gut feeling. Employees should verify unusual requests through a second, known-good channel — a saved number, the official app — never through contact details supplied by the message itself. Continuous security awareness training keeps that reflex current.
  • Assume caller ID and display names are attacker-controlled. Neither is proof of identity, and policy should say so explicitly for payment and credential requests.

Related terms

PhishingPhishing is a social engineering attack that uses fraudulent emails, websites, or messages to trick people into revealing sensitive information or installing malware.TyposquattingTyposquatting registers look-alike domains — misspellings or swapped characters — to catch mistyped URLs and lend fake emails and sites credibility.PharmingPharming is an attack that silently redirects users from legitimate websites to fraudulent copies by corrupting DNS resolution — no click on a bad link required.VishingVishing (voice phishing) is a social engineering attack conducted over phone calls to manipulate victims into revealing sensitive information or taking harmful actions.
See your Human Risk Score

NOUSEC simulates attacks across 8 channels and turns the results into one number your board can read.

Book a demo