Spoofing is when an attacker fakes the identity on a message or connection — the sender address on an email, the number on a caller ID, the name on a login page — so a person or a system trusts something that is not what it claims to be. It does not break into anything on its own; it buys the attacker the trust they need for the attack that follows, which is why spoofing sits behind most phishing, business email compromise and voice scams in 2026.
TL;DR
- Spoofing fakes an identity; phishing uses the fake identity to steal logins, money or data.
- The four types staff actually meet: email spoofing, caller ID and SMS spoofing, website spoofing and IP spoofing.
- Verizon's 2025 Data Breach Investigations Report analysed 22,052 incidents and again found a human element in roughly 60% of breaches (full report PDF) — spoofing works because it targets people, not machines.
- Email authentication (SPF, DKIM, DMARC), multi-factor authentication and a one-click report button stop most spoofed attempts before they cost anything.
- A phishing simulation programme measures whether your staff can spot a spoofed message before a real one arrives.
What spoofing means in plain terms
Spoofing is forgery of the outer envelope, not a break-in through the door. The attacker does not need access to your systems — they need your mail server, your phone or your browser to display something false. Everything downstream (a click, a payment, a password) is a separate attack layered on top of that lie.
That distinction matters because the defences are different too. You cannot patch a person into not trusting a familiar name; you can make the envelope harder to forge and train people to check what is inside it.
Email spoofing
Email spoofing is the most common form. The mail protocol that still carries most of the world's messages was designed in an era when nobody assumed senders would lie, so the address a mail client displays is a claim the sender makes about themselves. Without extra checks, any server can claim to be anyone.
Three records close that gap:
- SPF publishes which servers are allowed to send mail for your domain.
- DKIM cryptographically signs each message so it cannot be altered in transit.
- DMARC tells receiving servers what to do when both fail — and sends you a report about it.
Set all three and naive spoofing of your domain stops working, which matters most when attackers impersonate your staff to your clients. What it does not stop is a spoofed display name sent from a legitimately registered lookalike domain, which is where the human layer has to hold. Cyber Aware's phishing simulations test exactly that gap with lookalike-domain and display-name lures.
Caller ID and SMS spoofing
Phone networks inherit an older trust model. Caller ID presents a number the caller claims to be, and for decades it was accepted at face value. SMS carries no sender authentication at all by default. The result is the most successful consumer-facing scams in Australia: the fake bank calling about a suspicious transaction, the Hi Mum text from a new number, the delivery notice with a short link.
Australian Communications and Media Authority rules now require carriers to block, verify or label suspected scam calls and SMS, but those controls are carrier-side, not under your control. For staff, the practical rule is behavioural, not technical: a caller claiming to be from your bank, the ATO or your own IT team is verified by hanging up and calling back on a number you look up yourself — never on a number the caller gives you.
Website spoofing
Website spoofing replaces the destination, not the message. The attacker registers a lookalike domain — an rn for an m, a hyphen where none belongs, yourbrand-accounts.com — and rebuilds your login page pixel for pixel. A user who clicks through from an email never reads the address bar, and modern browsers display less of the URL than they used to.
The tells that still work:
- Read the domain from right to left, starting at the extension, before typing anything.
- Treat a login page reached from a link as unverified until proven otherwise; navigate to the site yourself.
- Multi-factor authentication is the safety net — a stolen password is worth far less when a second factor stands behind it.
IP and network spoofing
IP spoofing is the technical end of the family: an attacker forges the source address on network packets. End users never see it, and its modern role is mostly in denial-of-service floods and bypassing naive IP allowlists, not in stealing passwords. If your firewall rules trust an internal address range, that trust is what an attacker spoofs. It is an infrastructure control problem — keep it on the IT team's list, not in the training curriculum.
How to tell a spoofed message
| Tell | What you are seeing |
|---|---|
| The display name is right but the address is not | Lookalike-domain email spoofing |
| The address is right but the reply-to is different | Redirect spoofing — the reply goes to the attacker |
| A known contact asks for an urgent payment change | Spoofed or compromised identity; verify out of band |
| The message creates urgency and offers no other channel | Classic social engineering pressure |
| A link's visible text differs from its destination | URL spoofing — hover before you click |
What stops spoofing
| Spoof type | Technical control | Human control |
|---|---|---|
| SPF, DKIM and DMARC; inbound impersonation protection | Verification habits for payment and credential requests | |
| Caller ID and SMS | Carrier scam filtering; number-verification services | Call-back on an independently sourced number |
| Website | Multi-factor authentication; domain monitoring for lookalikes | Address-bar checks; a report button for suspicious mail |
| IP | Ingress filtering; zero-trust network access | None required — staff never see it |
The pattern in the table holds across every spoofing type in 2026: technology narrows what can be faked convincingly, training covers what remains. ASD received more than 84,700 cybercrime reports in FY2024-25, an average of one every six minutes, with small businesses self-reporting an average cost of $56,600 per incident (ASD Annual Cyber Threat Report 2024-25). Spoofed messages are how a large share of those incidents start.
If you are not sure whether spoofing or something else is your biggest exposure, a security gap assessment ranks your controls before you spend.
FAQ
What is spoofing in simple terms? Faking the identity on a message or connection so the recipient trusts a source that is not genuine. The click, payment or password that follows is a separate attack built on that lie.
Is spoofing the same as phishing? No. Spoofing is the forgery of the identity; phishing is the attack that uses it. A spoofed email is the lure; the fake login page and the stolen credential are the phishing.
Can spoofed emails be detected? Most, yes. SPF, DKIM and DMARC authentication catch domain forgeries, and modern email security adds display-name and lookalike-domain detection on top. The residual risk is low-volume, hand-crafted lures.
How do I stop my domain being spoofed? Publish SPF, DKIM and a DMARC policy, starting at monitoring and moving to enforcement. That stops third parties sending mail as your domain — it does nothing against lookalike domains, which is why staff training still matters.
What should staff do when they receive a spoofed message? Report it with one click, do not reply, and verify any request it contains by contacting the claimed sender through a channel you sourced yourself.
One last thing
Check your own domain's DMARC policy today. A large share of Australian small businesses have either no DMARC record or one set to monitor-only, which means any server on the internet can still send mail as them — the cheapest fix in this entire article.