Spoofing

Phishing is mainly carried out through email spoofing and text messages. A message that seems to come from a trusted sender can lead the victim to give away personal, financial, or other sensitive information, or to click a link or attachment that infects the device with malware. NIST counts impersonating, masquerading, piggybacking, and mimicking as forms of spoofing.

Email spoofing makes a message look as if a reputable organization sent it, and the spoofed message can then target that organization's customers or its own staff. Caller ID can be spoofed so that a call appears to come from a legitimate company or institution. Spoofed websites use look-alike addresses, such as common misspellings of well-known domains or characters from other alphabets that look almost identical to Latin letters. A known sender is therefore not necessarily a trusted one.

Domain owners reduce email spoofing with SPF, DKIM, and DMARC, which together lower an attacker's chance of running malicious email campaigns that borrow the organization's reputation. Domains that send no email need the same DNS records. Receiving mail systems should honor the sender's DMARC policy and quarantine or reject messages that fail validation. For a suspicious call, the Canadian Centre for Cyber Security advises ending it and contacting the organization through a publicly listed phone number or official website.