What is Spoofing? Attack Types, Examples, and Prevention

An email carries your CEO's name. A call appears to come from a regular vendor. A website looks almost identical to the service your team uses every day.

None of those signals proves that the person or company behind the communication is genuine.

Spoofing is a cyberattack technique that disguises identity or origin so a message, call, website, or network connection appears to come from a trusted source. Attackers use that borrowed trust to bypass scrutiny, support phishing attacks, redirect payments, steal credentials, or deliver malware.

What is Spoofing in Cybersecurity?

Spoofing means falsifying the apparent source of a communication or technical connection. The imitated target might be a person, company, email domain, phone number, website, or IP address.

Every spoofing attack creates a gap between appearance and reality. A display name says “CEO,” but the mailbox belongs to a stranger. A login page uses the correct logo, but the domain belongs to an attacker. A familiar number appears on caller ID, but the call originated elsewhere.

Spoofing is the identity layer of the deception. What happens next depends on the attacker's goal: the false identity may persuade someone, evade a technical control, conceal malicious traffic, or reinforce another attack.

How Does a Spoofing Attack Work?

The attacker first chooses an identity or source the target is likely to trust. They then manipulate a visible or technical signal so it resembles that source. Common spoofing and impersonation techniques include forging email header information, changing a display name, registering a lookalike domain, falsifying caller ID, or copying a legitimate website.

The imitation doesn’t have to survive expert analysis. It only has to look credible in the few seconds it takes someone to decide whether to reply, click, sign in, share information, or approve a transaction.

6 Most Common Types of Spoofing

Spoofing can describe a wide range of technical attacks. Here are the most important types of spoofing.

Email & Domain Spoofing

Email spoofing makes a message appear to come from an address or domain other than its true source. A message that looks internal may receive less scrutiny than one from an unknown external sender.

SPF, DKIM, and DMARC help receiving systems determine whether messages claiming to represent a domain are authorized. CISA recommends these controls to reduce email threats such as spoofing and phishing.

Adaptive Security's DMARC guide explains how the protocols work together.

Display-Name Spoofing

An attacker can use an unrelated email account and set its display name to “Jane Smith, CEO” or “Accounts Payable.” The underlying address isn’t forged, but the name shown in the inbox creates a false impression.

This tactic can be especially effective on mobile devices, where the full address may be hidden until the recipient expands the sender details. It also shows why email authentication alone cannot validate every apparent identity.

Lookalike-Domain Spoofing

Attackers register domains designed to look like legitimate ones. They may add or remove a character, reverse two letters, substitute a visually similar character, or use a different top-level domain.

Because the attacker owns the lookalike domain, messages from it may pass SPF, DKIM, and DMARC for that domain. The FBI warns that criminals use slight variations on legitimate addresses in business email compromise (BEC) scams.

Caller-ID Spoofing

Caller-ID spoofing changes the name or number displayed for an incoming call. The FTC cautions that scammers can make a call appear to come from a familiar company, government agency, or local number.

A recognizable number is therefore not a proof of identity, but instead a prompt to verify. An attacker may combine the false number with social engineering or an AI-generated voice.

Website Spoofing

A spoofed website imitates the branding, layout, domain appearance, or login flow of a legitimate site. Attackers commonly use these sites to collect usernames, passwords, authentication codes, payment details, or other sensitive information.

Attackers may send users to a fake page through a phishing email, text message, search advertisement, QR code, or mistyped web address. A polished design and a valid HTTPS connection don’t prove the site belongs to the organization it claims to represent.

IP Spoofing

IP spoofing alters the source address in network packets so traffic appears to originate somewhere else. Unlike display-name or caller-ID spoofing, it often targets technical systems rather than people. Attackers may use it to conceal a source, impersonate a trusted host, or support denial-of-service activity.

Spoofing vs Phishing: What Is the Difference?

Spoofing manipulates identity, while phishing manipulates behavior. A spoofing technique makes something appear to come from a trusted source, while a phishing attack tries to persuade someone to click, disclose information, transfer money, install malware, or take another harmful action.

They often work together, but neither requires the other. A phishing message can come from an obviously unrelated address, and IP spoofing can attack a system without asking an employee to do anything.

See this full spoofing and phishing comparison for examples and differences in defenses.

What Does a Spoofing Attack Look Like?

Suppose an accounts-payable employee receives an email that appears to come from a regular vendor. The sender name is correct, the message uses familiar branding, and it refers to a real outstanding invoice. The vendor supposedly changed banks and wants future payments sent to a new account.

The only obvious warning sign is a single-character change in the sender's domain. The attacker researched the business relationship, registered a lookalike domain, and wrote a request that fits an expected workflow. Because the attacker controls the fake domain, the email may pass authentication for that domain.

If the employee changes the payment instructions without calling the vendor through a known number, the next payment may go to the criminal. That pattern is part of the broader BEC problem.

The FBI's 2025 Internet Crime Report recorded 24,768 BEC complaints and about $3.05 billion in reported losses. BEC includes several methods beyond spoofing, but the figures show the financial stakes of trusted-identity fraud.

Here’s How AI is Changing Spoofing & Impersonation

AI gives attackers more ways to reinforce a false identity. Attackers can pair a spoofed phone number with a cloned voice, and synthetic video can imitate an executive.

Generative tools can produce messages that resemble normal business communication and adapt them to a target's role or current projects.

A familiar voice, face, writing style, or number can make an impersonation more convincing, but none is reliable proof of identity. Organizations need verification procedures that remain effective when the communication itself looks and sounds authentic. AI deepfake phishing training can help employees practice that decision.

How Do I Identify Spoofing?

No single clue identifies every spoofing attack, so treat the following signals as reasons to slow down and verify:

• The display name is correct, but the address isn’t. Expand the sender details and inspect the complete address.
• The domain is almost right. Look for added, missing, transposed, or visually similar characters, as well as unexpected domain endings.

• The reply-to address is different. A message may show one sender while directing responses elsewhere.
• A familiar person makes an unfamiliar request. Payment changes, credentials, sensitive files, and exceptions to process deserve independent confirmation.
• The message creates pressure to act immediately. Urgency reduces the time available for verification.
• The conversation unexpectedly changes channels. A switch from work email to a personal number or messaging account may be an attempt to avoid controls.
• The link and destination don’t match. Inspect the actual destination before opening it, and when possible, navigate to important services through a saved bookmark.

Security teams investigating suspicious email can also examine routing and authentication data. Adaptive Security's guide to phishing email headers covers SPF, DKIM, DMARC, Reply-To, and Received fields.

5 Ways Organizations Can Prevent Spoofing Attacks

Here’s what a security team can do to help prevent spoofing attacks.

1. Configure & Enforce SPF, DKIM, and DMARC

SPF lists servers authorized to send on behalf of a domain. DKIM adds a cryptographic signature that helps verify message integrity and domain responsibility. DMARC checks alignment and tells receiving systems how to handle failed messages.

Organizations should inventory legitimate sending services, monitor reports, and move toward an appropriate enforcement policy. These controls reduce direct domain spoofing, but they don’t stop lookalike domains, display-name deception, compromised mailboxes, or impersonation outside email.

2. Monitor for lookalike domains and brand abuse

Watch for newly registered domains that resemble company, executive, product, and vendor names. Monitoring can help identify infrastructure before it’s used broadly against employees, customers, or partners. Establish an escalation path for investigation, registrar or hosting-provider abuse reports, and stakeholder notification.

3. Verify high-risk requests independently

Require a second, trusted channel for payment-detail changes, credential requests, sensitive-data transfers, and unusual exceptions. Call a vendor using the number already stored in company records or confirm an executive request through an established internal workflow.

Don’t use the phone number, link, or contact details included in the questionable message. The FBI recommends independently verifying payment requests and changes in account information.

4. Protect legitimate accounts

A criminal who compromises a real mailbox can impersonate its owner without spoofing the domain. Use phishing-resistant multifactor authentication where possible, restrict access, monitor anomalous logins and inbox rules, and remove stale accounts and permissions. CISA explains how MFA reduces unauthorized access.

5. Train employees to verify identity

Employees need more than a checklist of suspicious links and spelling errors. Training should expose them to realistic requests from familiar-looking senders across email, voice, and video, then reinforce the approved verification and reporting process.

Personalized phishing simulations and ongoing security awareness training help turn verification into a repeatable habit.

What To Do After a Successful Spoofing Attack

Act quickly and preserve evidence. The exact response depends on what the attacker accomplished:

• Stolen Credentials: Reset the affected credentials, revoke active sessions and tokens, enforce MFA, and review sign-ins, forwarding rules, recovery methods, and connected applications.
• Fraudulent Payment: Contact the financial institution immediately and ask whether the transaction can be stopped or recalled. Report the incident to law enforcement and the FBI's Internet Crime Complaint Center.
• Malware or Unauthorized Access: Isolate affected systems as appropriate, preserve logs, and begin the organization's incident-response process.
• Brand Impersonation: Determine whether other employees, customers, or vendors were targeted; preserve domains, URLs, messages, phone numbers, and email headers; and pursue appropriate takedown and notification steps.

Use the incident to identify the failed control or workflow. Then update mail rules, verification procedures, reporting paths, and targeted training while the details are still clear.

Build Verification Habits Before a Spoofing Attack

Spoofing succeeds by making a familiar trust signal unreliable. Technical controls can block many attempts, but employees still need to ask a basic question before acting on a sensitive request: Is this really who it appears to be?

Adaptive Security helps organizations prepare employees for modern impersonation attacks with simulations across email, voice, and deepfake video.

For a broader view of how spoofing relates to phishing and spam, download Phishing, Spam, or Spoofing? The 2026 Threat Identification Guide. The guide explains where the threats overlap and which technical and behavioral controls address each one.

Phishing, Spam, or Spoofing? The 2026 Threat Identification Guide

Get the checklistGet the checklistGet the checklist

Frequently Asked Questions

What is a spoofing attack in simple terms?

A spoofing attack makes a communication or technical connection appear to come from a different, usually trusted, source. Examples include a forged email sender, fake caller ID, lookalike website, or altered source IP address.

What is an example of spoofing?

An attacker might register a domain that differs from a vendor's domain by one character, then email the vendor's customer with fraudulent bank details. The message appears familiar, but it comes from infrastructure controlled by the attacker.

Is spoofing the same as phishing?

No. Spoofing falsifies identity or origin; phishing manipulates a person into taking an action. Attackers often use spoofing to make phishing more convincing.

Can an email pass SPF, DKIM, and DMARC and still be malicious?

Yes. A message from an attacker-controlled lookalike domain can pass authentication for that domain, and a message from a compromised legitimate account may also pass. Evaluate authentication results with the sender, domain, behavior, and request context.

Does DMARC stop all email spoofing?

No. An enforced DMARC policy helps stop unauthorized use of a protected domain in the visible From address. It doesn’t prevent display-name spoofing, lookalike domains, compromised accounts, or impersonation through phone, text, and websites.

Can caller ID be trusted?

Don’t treat caller ID as proof of identity because scammers can falsify the displayed name and number. Verify sensitive requests through a number or channel you already know.

How can employees report suspected spoofing?

Employees should use the organization's designated reporting button, help desk, security mailbox, or incident channel. They should avoid replying, clicking, or using contact information in the suspicious message and preserve the original communication for investigation.

What is the best way to prevent spoofing-related fraud?

Use layered defenses: Enforce SPF, DKIM, and DMARC; monitor lookalike domains; protect legitimate accounts with strong authentication; require independent verification for high-risk requests; and train employees with realistic impersonation scenarios.