How to recognise email impersonation

Impersonation techniques can fool both antispam filters and the recipient. These messages usually try to get you to open an attachment, visit a link or hand over credentials.

These are the signs worth checking before you trust a request for payment, access or a download.

Sender spoofing

This means tampering with the sender address so the message appears to come from someone else. Keep the antispam turned on, but do not treat it as absolute protection. SPF, DKIM and DMARC add complementary checks for the domains you control.

Fake name, real sender

Although some systems detect domain spoofing, not every impersonating message is easy to spot. Another variant changes the display name.

When you send an email you can set a name that goes with the sender address, to tell people which person or company it comes from. The name can be anything the sender likes, and whenever it is present the webmail or email client shows it in the sender information, sometimes even hiding the address, because it is the key detail that makes the sender look familiar, e.g. the person's full name.

The display name is set by the sender, and authentication standards do not prove that it belongs to the person named. Filters can detect some impersonation attempts, but the attacker could even use a known address as the name.

This is why some attackers use the technique to impersonate others. For example, an email comes from usuario@dominioexterno.com but the name this sender sets is ayuda@banco.com. When the user receives it, the email client gives more prominence to the name, in this case ayuda@banco.com, which causes the confusion.

At the same time, the message may genuinely come from usuario@dominioexterno.com, which makes it hard to tell automatically whether the displayed name is trying to deceive.

Campaigns change their links, attachments and text often, so no antivirus or filter should be considered a guarantee against a new variant.

Whenever in doubt, expand the full address and check the domain character by character, any authentication warnings and any different Reply-To. A real address or an authenticated message does not rule out that the account has been compromised.

Reply within a known conversation

An attacker can reply within a real conversation if they have gained access to an account or to earlier messages. Recognising the subject or the history does not prove that the new request is legitimate.

The message will usually push the need to sign a document, contract or new price list, without giving any more information, keeping it as generic as possible to avoid doubts so the recipient opens the attachment.

Do not open unexpected attachments or links. Confirm the request through an independent channel you already knew, such as a usual phone number; do not reply to the same message or use contact details included in it, because the account could be compromised. Also keep your computer and its security protection up to date.

Spam sent from your own account

It can also happen that the victim is the recipient's own account. We cover this case in the following guide

If you have already interacted with the message

If you have entered credentials, change them from the service's usual address and check sessions, forwarders and logins. If you have opened a suspicious attachment, check the computer and avoid using that session to change passwords. If you are asked to change a bank account or make a payment, confirm the details through a known independent channel.

Keep the original message and its headers so it can be analysed. A screenshot of the display name is not enough. A correct SPF, DKIM or DMARC result does not rule out that the legitimate account has been compromised either.