Email Management: Email Spoofing

What is email spoofing?

Spammers will often forge email headers in an attempt to trick users into opening or even responding to what appears to be a legitimate email. The email header may seem to have originated from a friend, business acquaintance, or product or service that a user may have. This tactic is often used in spam and phishing campaigns, and although it is mostly a nuisance, there can be malicious forms also.

One should NEVER respond to any email that is asking the user for sensitive data or information like passwords, credit card or social security numbers. NEVER, EVER click a link in a suspicious email! Legitimate companies will not request their customers to submit private data via email.

How can you tell if your email address was used in a spoofing campaign?

Your inbox may all of a sudden get flooded by bounce messages listing a variety of reasons of why the messages are getting bounced. This typically does NOT mean that your personal computer has been hacked. If you are concerned, you should immediately change your email account password to be safe.

If you have access to your email header you can often spot issues. In the example below

the addresses From: and Reply-To: are different
You may think you are writing to yourboss@example1.com
but in reality, your response is going to badguy@example2.com.

mail from: user1@example1.com
rcpt to: badguy@example2.com
data

From: YourBoss <yourboss@example1.com>
Subject: Raise!
Date: February 13, 2019 3:30:58 PM EDT
To: user1 <user1@example1.com>
Reply-To: YourBoss <badguy@example2.com>

Hi User1

Please reply back to this message for details on your raise.
Regards,
YourBoss

This is but one simple example of the various ways you can spot a spoofed email, there are many other examples one can find in a Google search.

How can I avoid becoming a spoofing victim?

Keep your antivirus software updated.
Add a TXT/SPF Record to your DNS.
Never respond to or click a link in a suspicious email.
If you are in doubt about the authenticity of an email, contact the friend or business for verification separately.
Change your email password frequently.

There is nothing you could really do once an email has been spoofed. The bounced emails you receive may contain information that could be useful to track down the source of the email. They often come from infected computers, so getting the exact location of the spammer is pretty low. You may also find the IP address where the message originated, check which ISP it belongs to, and see if they would be willing to blacklist the IP address.

Until stronger email protocols are in place, this will continue to be an issue. Other options may be to purchase more secure email offerings like Microsoft 365 or G Suite.