Threat Intel
Basic Email Spoofing: Why You Can't Trust the “From” Line
Originally published: May 5, 2015 · Reviewed & updated: October 2026
George Halfkenny · Founder, Identity Defense 247
Originally published: May 5, 2015 · Reviewed & updated: October 2026 I'm a self-proclaimed software geek who has spent over twenty years building systems that move information. Whether I was acting as the Network Administrator for Wilma Hansen Junior High back in 1996—before schools in Canada even prioritized teaching computers—or engineering interoperability frameworks during telecom deregulation, the core challenge is always the same: making disparate systems talk to each other reliably. But there is a massive difference between a system being reliable and a system being truthful. Right now, we have a massive trust problem with email. It is called spoofing, and it is the digital equivalent of someone writing a fake return address on a physical envelope. Most people assume that if an email says it comes from “support@yourbank.com,” it actually originated from that bank's servers. It didn't. And after two decades of watching systems succeed and fail, I'll tell you exactly why.
The Architecture of the Illusion
The underlying technology we use to send email (SMTP) was designed decades ago. It was built for velocity and reliability, not security. It was engineered for a time when the internet was a closed network of universities and government agencies who already trusted each other.
Because of that legacy architecture, there is almost zero friction stopping a malicious sender from altering the “From” field. A hacker can spin up a server, write a script, and blast out ten thousand emails that look exactly like they came from the CEO of your company or the fraud department of your bank.
If you are just looking at the display name on your phone screen, you are going to get fooled. I don't care how smart you are; when you are moving fast and trying to clear your inbox, the friction of verifying a sender usually gets skipped. Attackers bank on that human behavior.
[2026 update] The industry has since bolted verification onto email. SPF, DKIM, and DMARC let a domain prove which servers are allowed to send its mail. Google and Yahoo began requiring all three from bulk senders in February 2024, and Microsoft extended the same rules to Outlook.com, Hotmail, and Live.com senders in May 2025. That's real progress, and it protects domains, not people. Display-name spoofing and look-alike domains still land in inboxes every day. Start with CISA's phishing guidance: [https://www.cisa.gov/secure-our-world](https://www.cisa.gov/secure-our-world)
How to Look Under the Hood
You cannot rely on the display name. You have to look at the actual routing data. Call me old school, but I am unwilling to trust a digital request for my credentials without verifying the headers.
1. Check the Reply-To Address: The attacker might be able to fake the “From” line, but if they want you to reply with your password or account details, they have to route the reply back to themselves. Hit “Reply” (but do not send). Look at the email address that populates in the “To” field. If the email claims to be from your bank, but the reply-to address is a random webmail account or a slightly misspelled domain (like yourbnk.com), you are being spoofed.
2. Inspect the Email Headers: Every email carries a hidden digital passport called the “header.” It shows exactly which servers the email bounced through before hitting your inbox. In most email clients, you can click “Show Original” or “View Headers.” If the IP address of the sender doesn't match the actual organization they claim to represent, it is garbage. Delete it.
3. Never Click the Link: If an email tells you your account is locked and provides a helpful link to unlock it, ignore the link. Open a fresh browser window, manually type in the web address of your bank, and log in directly.
Technology changes rapidly, but the discipline of security doesn't. We cannot stop attackers from faking the return address on the envelope, but we can stop blindly trusting the mail delivery. Move predictable verification into your daily routine, and save your trust for the systems you can actually verify.
From Personal Blog to Identity Defense 247
I wrote this post in May 2015. I've owned this domain since 2014, and the years between 2014 and 2026 turned this blog into my workshop, the place where I think out loud about the failure modes I've watched systems hit for two decades, including this one: email's “From” line is a claim, not proof.
Eleven years later, what strikes me isn't how much has changed. It's how much hasn't. Email finally got the verification layer it always needed, yet small businesses still fall for the same three tricks, because authentication can't fix human trust. Only habits can. That's why the three checks above are as load-bearing in 2026 as they were in 2015.
What changed for me is that the workshop became a company. Identity Defense 247 applies the same verify-before-you-trust discipline this post describes, but continuously: scanning your domain for credentials already circulating on the dark web, alerting your team the moment a new one surfaces, and handing you a board-ready report instead of a fire drill. The company is what the blog grew into.
Header Image Prompt
Editorial photograph of a paper envelope on a dark desk, its return-address corner peeling back to reveal a second hidden address beneath, single desk lamp lighting from the side, deep charcoal and off-white palette with one muted red accent, quiet suspicion mood, generous negative space on the right third for headline overlay, 16:9, no readable text, no logos, no hooded figures.