Spoofing

What is Spoofing?

The definition of spoofing is a type of scam where a hacker forges their identity to imitate a legitimate business or reliable source. In a spoofing scam, the cybercriminal will attempt to trick the victim into handing over personal information, such as account or payment details, so they can steal it to commit cybercrime.

Threat actors can disguise their identities in a number of ways, including forging their email, website, IP address, caller ID, or GPS location.

How Spoofing Works

In a spoofing scam, the hacker aims to disguise their identity to try and trick a victim into handing over personal information. Typically, this is done by spoofing an email header, website, or caller ID.

Spoofing, in a cybersecurity context, is often used to enable social engineering and phishing scams. In a common phishing scam, a fraudster may spoof their email header to obfuscate who sent the email.

They could do this by imitating a reputable organization, such as Microsoft Office 365 customer support, and then trying to persuade the user to click on a malicious link or attachment.

In such a scam, clicking on the link could redirect the user to a spoofed website that imitates the Microsoft Office 365 login portal, trying to trick the user into handing over their username and password. Likewise, clicking on the attachment could download malware to the user’s device.

Types of Spoofing

As mentioned above, spoofing attacks can come in all different shapes and sizes.

Some of the most common types of spoofing attacks include:

Phishing vs. Spoofing

Phishing and spoofing are two types of scams that rely on misdirection, but they have a distinct difference.

Essentially, phishing is a technique designed to trick a user into handing over information, whereas spoofing is a technique used by an attacker to disguise their identity, involving creating a false website, URL, or caller ID so they can appear to represent a legitimate source.

Both phishing and spoofing can be used as part of a single cyber attack. For instance, in a phishing scam, a hacker might spoof an email header and link to a spoofed website to make the misdirection more convincing.

How to Detect Spoofing

Detecting spoofing can be very difficult, but there are some basic ways that you can detect website, email, and caller ID spoofing.

A brief summary of these can be found below:

7 Ways to Protect Yourself From Spoofing

There are a wide range of ways to protect yourself against spoofing attacks.

Some of the most effective include:

Is Spoofing Illegal?

Yes and no. Regulators such as the Federal Communications Commission (FCC) consider spoofing illegal if it is done with the “intent to defraud, cause harm, or wrongly obtain anything of value.” So, if someone spoofed their phone number to try and steal your personal data, then this would be illegal, and they would be exposed to penalties of up to $10,000 per violation.

That being said, the FCC does highlight cases where spoofing would be considered legal. For example, if a doctor calls a patient from a personal mobile phone and displays their office phone number rather than their personal phone number, or if a business displays a toll-free call back number.

The Bottom Line

Now you know the meaning of spoofing, the best way to protect against it is to never take what you see online at face value. Just because a website, email, or caller ID appears legitimate, doesn’t mean that it is. Verifying the identity of senders online is critical to reducing the chance of being scammed.

FAQs