What Is Spoofing?
Spoofing is a sort of scam in which a criminal alters a target’s email address, display name, phone number, text message, or website URL to make them believe they’re communicating with a recognized, trustworthy source.
Spoofing usually entails modifying just one letter, number, or symbol in the transmission to make it appear valid at first glance. You might, for example, receive an email from Netflix that uses the phony domain name “netffix.com.”
KEY TAKEAWAYS
- Spoofing to trick you into divulging personal information can be done thru email, text messages, caller ID, and even GPS receivers.
- Be skeptical of any request for personal information; download files only from trusted sources; and install reputable antivirus and antimalware software.
- If you think you’ve been spoofed, file a complaint at the Consumer Complaint Center of the Federal Communications Commission (FCC). If you have lost money, contact the local police.
How Spoofing Works
Spoofing criminals try to gain your trust, and they count on making you believe that the spoofed communications are legitimate. Often, using the name of a big, trusted company—such as Amazon or PayPal—is enough to get targets to take some kind of action or reveal information.
A phoney email from Amazon, for example, can imply a problem with a recent purchase, leading you to click on the link to learn more (hint: don’t click on the link).
You could be sent to a bogus login page, where you inadvertently input your username and password, or you could download malware from that site.
Spoofing can lead to the disclosure of personal and financial information, the transfer of funds, and the download of malware, all of which can result in compromised machines, financial fraud, and identity theft.
Spoofing can be used to propagate malware via links and attachments, circumvent network access controls, and limit access via denial-of-service (DoS) attacks. Spoofing in the workplace can result in infected computer systems and networks, data breaches, and revenue loss.
There are several kinds of spoofing, including email spoofing, text message spoofing, caller ID spoofing, and URL and GPS spoofing. Essentially, if there’s a form of online communication, spoofers are trying to scam their way into it—and into your identity and your assets.
Special Considerations
There are several ways to protect yourself from would-be spoofing scammers:
- Turn on your email’s spam filter. This will prevent many spoofed emails from ever landing in your inbox.
- Don’t click on links or open attachments in emails from unknown senders. If there’s a chance that the email is legitimate, reach out directly to the sender to confirm that it’s real.
- If you get a suspicious email or text asking you to log into your account for some reason, don’t click on the provided link. Instead, open a new tab or window (or the dedicated app on your phone) and log in directly to your account.
- Display file extensions in Windows. Windows does not display file extensions by default, but you can change the setting. To do so, click the “View” tab in File Explorer and check the box to show file extensions. While this doesn’t prevent scammers from spoofing file extensions, you’ll be able to view any spoofed extensions and avoid opening any malicious files.
- Invest in reputable cybersecurity software. Good software will alert you about potential threats, stop downloads, and prevent malware from taking over. Keep in mind that the software only works if you keep it updated and use it regularly.
- If you get an inquiry seeking personal information, don’t provide it. Hang up (or log off) and then look up the phone number or customer service email address from the entity purportedly contacting you for your personal information.
If you think you’ve been spoofed, you can file a complaint at the Consumer Complaint Center of the Federal Communications Commission (FCC). The FCC doesn’t act on individual complaints but will add that information to its database. If you’ve lost money because of spoofing, the FCC recommends contacting your local police department.
Types of Spoofing
Email Spoofing
Email spoofing is when someone sends you an email with a fake sender address, usually as part of a phishing scam to steal your information, ask for money, or infect your machine with malware. Both dishonest advertisers and downright crooks employ this strategy.
The spoofer sends emails with a forged “From:” line, leading victims to believe the message is coming from a friend, their bank, or another trustworthy source. Any email requesting your password, social security number, or other sensitive information could be a scam.
These emails typically include a combination of deceptive features, including:
- False sender addresses that look like someone who you know and trust
- A missing sender address, or at least one that is hard for the average user to find
- Familiar corporate branding, such as logos, colors, call-to-action buttons, and the like
- Typos, bad grammar, and unusual syntax (e.g., “Good day sir, please made certain this data is well and good”).
Text Message Spoofing
Sometimes referred to as “smishing,” text message (SMS) spoofing is similar to email spoofing. The text message appears to come from a legitimate source, such as your bank or a doctor’s office.
It may request that you call a specific phone number or click on a link within the message to get you to divulge personal information.
Caller ID Spoofing
Here, the spoofer falsifies the phone number from which they are calling in the hope of getting you to take their call. On your caller ID, it might appear that the call is coming from a legitimate business or government agency, such as the Internal Revenue Service (IRS).
Note that the IRS says it doesn’t call taxpayers to tell them they owe taxes without first sending them a bill in the mail.
Spoofing comes in many forms, but the goal is usually to trick people into divulging personal information that criminals can use.
Neighbor Spoofing
This is a type of caller ID spoofing in which the call appears to be from someone you know or a person who lives near you. The FCC says that the Truth in Caller ID Act prohibits “anyone from transmitting misleading or inaccurate caller ID information with the intent to defraud, cause harm, or wrongly obtain anything of value.”
If they’re caught (and that’s a big “if”), the spoofer can face penalties of up to $10,000 for each violation.
URL or Website Spoofing
URL spoofing happens when scammers set up a fraudulent website to obtain information from victims or install malware on their computers. For instance, victims might be directed to a site that looks like it belongs to their bank or credit card company and be asked to log in using their user ID and password.
If the person falls for it and logs in, the scammer could then use the information that the victim typed in to log into the real site and access their accounts.
GPS Spoofing
GPS spoofing has a somewhat different purpose. It attempts to trick a GPS receiver into believing it is in a different location or headed in a different direction by broadcasting bogus GPS signals or other means.
At this point, GPS spoofing is more likely to be used in warfare or by gamers (e.g., Pokémon GO players) than to target individual consumers, although the technology exists to make anyone vulnerable.
Man-in-the-middle (MitM) Attacks
These spoofing attacks involve three players: the victim, the entity that the victim is trying to communicate with, and the “man in the middle” who intercepts the communications. The spoofer attempts to eavesdrop on the exchange or impersonate one of the parties.
The goal is to intercept information that is useful, sensitive, or potentially profitable (e.g., login credentials and credit card information). Stolen information can be used to approve financial transactions, for identity theft, or it may be sold to a third party.
IP Spoofing
This type of scam happens when someone wants to disguise or hide the location from where they’re sending or requesting data, so they replace the source Internet protocol (IP) address with a fake one.
The spoofed IP address looks like it’s from a trusted source (the original IP address) while m asking its true identity: an unknown third party.
Facial Spoofing
This is the latest form of spoofing. With facial spoofing, a criminal uses a person’s face and simulates their facial biometrics by using a photo or video to replace their identity.
Facial spoofing is most commonly used to commit bank identity fraud. However, it is also used in money laundering.
How to detect spoofing
Because spoofing can be complex, paying close attention to the nuances and trusting your intuition is essential.
Websites without lock symbols or green bars should be avoided, as should URLs that begin with HTTP rather than HTTPS, the encrypted form of HTTP. Another symptom of a bogus website is if your password manager doesn’t autofill your login, which indicates that it doesn’t recognise the site.
Examine the sender’s address carefully while receiving emails, keeping in mind that scammers will use bogus domains that appear extremely similar to authentic ones.
Of course, typos, poor language, and strange syntax are all red flags in an email. If you’re still not sure, copy and paste the email’s text into Google, where a fast search will provide the answer.
Finally, before clicking on an embedded link, hover over it to discover the URL. It’s most likely a fraud if the URL appears dubious.
Hold your finger on a link on your smartphone for a few seconds to hover over it. The complete URL of the link will be displayed in a pop-up window. This can assist you figure out whether the connection is trustworthy or not.
Caller ID on phones is easily spoofable. Scammers frequently employ neighbour spoofing to make calls appear to be coming from a local number. They could also impersonate a government organisation or a company you know and trust.
The Federal Communications Commission encourages individuals not to answer calls from unknown numbers and to hang up right away.
FAQs
What is the difference between spoofing and phishing?
The terms “spoofing” and “phishing” are often used interchangeably, but they mean different things. Spoofing uses a fake email address, display name, phone number, or web address to trick people into believing that they are interacting with a known, trusted source.
Phishing tricks you into providing personal data that can be used for identity theft. Many phishers use spoofing tactics to trick their victims into believing they are providing personal information to a legitimate, trusted source.
What is an example of spoofing?
A common spoofing scenario happens when an email is sent from a fake sender address asking the recipient to provide sensitive data.
Typically, the recipient is prompted to click on a link to log into their account and update personal and financial details. Links in spoofing emails also infect the recipient’s computer with malware.
What are some types of spoofing?
Spoofing takes many forms, including email spoofing, text message (SMS) spoofing, caller ID spoofing, website spoofing, GPS spoofing, IP spoofing, and facial spoofing.