Email Spoofing Examples: 6 Spoofed Emails and How to Spot Them
Email spoofing is forging the sender of an email so it appears to come from someone you trust. The six most common examples are display-name spoofing, lookalike domains, exact-domain spoofing, reply-to swaps, fake system notifications and, the one that isn't technically spoofing at all, a real account that's been taken over. The defense is the same for all six: check the full address, then confirm unusual requests another way.
Spoofing is a method, not a goal. Almost every spoofed email is trying to get you to sign in, pay or reply, which is why the FBI's Internet Crime Complaint Center files it alongside phishing: 191,561 phishing and spoofing complaints in 2025, plus $3.05 billion lost to business email compromise (IC3 2025 report).
1. Display-name spoofing
What you see: "Jordan Ellis, CEO" <jordan.ellis.office@gmail.com>
What's forged: only the name. The address is a real free mailbox the attacker opened in two minutes. Many phone email apps show only the name, so this is the most common spoof and the easiest to miss.
The check: tap or hover on the name to see the full address. Your CEO doesn't email you from a personal Gmail account about a wire transfer.
2. Lookalike domains
What you see: billing@yourcornpany.com, billing@yourcompany-co.com or billing@yourcompany.co
What's forged: nothing, technically. The attacker registered a domain that looks like yours or a supplier's: "rn" in place of "m," an extra hyphen, a different ending. Because they own it, it can pass every authentication check.
The check: read the domain after the @ slowly, letter by letter. If it's a supplier, compare it with an older email from them.
3. Exact-domain spoofing
What you see: payroll@yourcompany.com, character for character.
What's forged: the real address. This works only when the domain hasn't published a strict DMARC policy (more on that below). Your email provider may show a warning banner, a "via" note or a question mark next to the sender.
The check: take any warning banner seriously. In Gmail, open the message, click More next to Reply, then Show original to see whether SPF, DKIM and DMARC passed (Google).
4. The reply-to swap
What you see: a normal-looking sender. Then you hit Reply, and the To line shows a different address.
What's forged: the reply path. The message may even come from a legitimate mailing service, but your answer goes straight to the attacker.
The check: before you send a reply that includes money, data or credentials, look at where it's going.
5. Spoofed system notifications
What you see: "Scanner" <scanner@yourcompany.com>, "You have a new voicemail," "A document has been shared with you."
What's forged: the look of an automated message from your own tools. People rarely question their own printer or phone system, which is exactly why these work. See our fake voicemail examples.
The check: open the tool itself (your voicemail, SharePoint, the e-signature app) rather than the link in the email.
6. The compromised real account (not spoofing, same result)
What you see: a message from a real supplier's real address, in an existing thread: "Our bank details have changed. Updated invoice attached."
What's forged: nothing. Someone took over the mailbox, so every authentication check passes. This is why "the address is right" can't be your only check.
The check: the request, not the sender. Confirm any change to payment details by phone, using a number you already have on file. Read more about business email compromise.
The six types at a glance
Each line shows what's forged · whether SPF, DKIM and DMARC stop it · the fastest check.
- Display-name spoofing: the name only · no, the address is real · look at the full address
- Lookalike domain: nothing (the attacker owns it) · no · read the domain letter by letter
- Exact-domain spoofing: the real address · yes, if the domain enforces DMARC · heed warning banners and check Show original
- Reply-to swap: where your reply goes · partly · check the To line before you send
- Spoofed notification: the look of your own tools · depends on the sender · open the tool directly
- Compromised account: nothing · no, it's the real mailbox · verify the request by phone
SPF, DKIM and DMARC in plain English
- SPF is a public list of the servers allowed to send email for a domain.
- DKIM is a digital signature that proves which domain signed a message and that it wasn't altered on the way.
- DMARC tells receiving servers what to do when a message fails those checks (nothing, send it to junk, or reject it) and sends the domain owner reports.
Together they stop exact-domain spoofing, but only when DMARC is set to quarantine or reject. They do nothing about display names, lookalike domains or hacked accounts, which is why the human check still matters.
For IT teams and MSPs: publish SPF and DKIM for every sending service, start DMARC at p=none to read the reports, then move to quarantine and reject. An "external sender" banner on outside mail also makes display-name spoofs of your own executives much easier to spot.
What to do with a spoofed email
- Don't reply, click or call any number in it.
- Report it. At work, use your email app's report option so your IT team sees it. At home, forward it to reportphishing@apwg.org and report it at ReportFraud.ftc.gov (FTC).
- If you already acted on it, tell IT or your bank right away. Speed matters far more than blame.
Frequently asked questions
What is email spoofing?
Forging the sender name or address on an email so it appears to come from someone you trust. See the email spoofing definition.
What's the difference between spoofing and phishing?
Spoofing is the disguise; phishing is the goal. A spoofed email fakes who sent it. A phishing email tries to get you to sign in, pay or hand over information. Most spoofed emails are phishing, but a phishing email doesn't have to be spoofed.
How can I tell if an email is spoofed?
Look at the full sender address, not just the name. Check the domain letter by letter, see where a reply would go, and take provider warning banners seriously. In Gmail, Show original shows whether SPF, DKIM and DMARC passed.
Can someone spoof my email address?
Someone can put your address in the From line. Whether it gets delivered depends on your domain's DMARC policy. If people receive emails "from you" that you didn't send, it's usually spoofing rather than a hack, but change your passphrase and turn on multi-factor authentication to be sure.
Does a passing SPF or DKIM check mean an email is safe?
No. It means the email really came from the domain it shows. A lookalike domain or a hacked account passes too. Always judge the request as well as the sender.
Practice spotting spoofs safely
Reading about spoofs helps you spot them; meeting them in your own inbox builds the habit. Hook Security's phishing simulations send safe versions of these patterns, like familiar-looking senders and internal notifications, so your team meets each one in a safe setting before a real one arrives.
Keep reading
Training courses on this topic
From Hook Security’s security awareness training library.
- 30 minWilderness Jack: Concrete JungleGet ready to trade pine trees for office plants! Wilderness Jack is back, and this time, he's venturing into the wildest terrain of all: corporate life. From phishing emails to deepfake scams, Jack tackles modern cybersecurity threats with his signature mix of grit, humor, and heart.
- 22 minAnnual Training with Wilderness JackAnnual Training with Wilderness Jack - Security awareness training featuring outdoor survival analogies for cybersecurity concepts.
- 30 minAnnual Training with...StevenThis year, we took cybersecurity training up a notch. From learning why cybersecurity matters to spotting the latest in digital threats, our annual training dives deep—and keeps it entertaining.
Ready to Strengthen Your Security Culture?
See how Hook Security can help protect your organization.