What is Email Spoofing? A Plain English Guide

You receive an email from your bank asking you to verify your account. The "From" address looks legitimate. But is it really from your bank? Maybe not. Welcome to the world of email spoofing.

The Envelope Analogy

Think of email like a physical letter. When you receive a letter, you see a return address on the envelope. But here's the thing: anyone can write any return address they want.

Nothing stops someone from writing "The White House, Washington DC" on an envelope and dropping it in the mail. The postal service will still deliver it.

Email works similarly. The "From" address you see? Anyone can set it to anything. Without proper protection, scammers can send emails that appear to come from your bank, your boss, or any company they choose.

The Scary Part

Basic email spoofing requires zero technical skill. There are websites where anyone can send emails appearing to come from any address. That's why email authentication protocols (SPF, DKIM, DMARC) were created.

Why Do Scammers Spoof Emails?

Spoofing makes scam emails more believable. If you receive an email from "no-reply@yourbank.com" about a security issue, you're more likely to click than if it came from "xyzscammer@random.com".

Common spoofing scams include:

• Fake invoices - "Your invoice from [Supplier] is attached" with malware
• Bank alerts - "Your account has been compromised, click here to secure it"
• Delivery notices - "Your package couldn't be delivered, pay $2 to reschedule"
• CEO fraud - "This is urgent, wire $50,000 to this account immediately"

How Can Businesses Prevent Spoofing?

Legitimate businesses can (and should) set up email authentication: SPF, DKIM, and DMARC. These are like digital signatures that prove an email actually came from the claimed sender.

When properly configured, these protocols tell email providers: "Only accept emails from our domain if they pass these checks. Block or quarantine everything else."

That's What TrustNope Checks

When you enter a domain in TrustNope, we check whether these protections are in place. A "Trust" verdict means the domain is well-protected against spoofing. A "Nope" means it's wide open.

What You Can Do

1 Check the domain - Use TrustNope (when available) to see if a domain can be easily spoofed
2 Verify through official channels - If an email asks for action, go to the company's website directly (don't click the link)
3 Look for red flags - Urgency, unusual requests, and threats are warning signs
4 When in doubt, call - Use a phone number from the official website, not from the email

The Bottom Line

Email spoofing is surprisingly easy - and that's exactly why email authentication exists. Legitimate businesses protect their domains. When they don't, anyone can send emails in their name.

TrustNope helps you see at a glance whether a domain is protected. But remember: even protected domains can have compromised accounts, so always verify unusual requests.