All about spoofing

An email that appears to be from your bank, but turns out to be fake. Or a phone call in which ‘Helpdesk Insurer’ appears on the screen, while on closer inspection it does not come from the insurer at all. They are two examples of spoofing. The term can best be described in Dutch as imitation. In this type of scam, someone pretends to be another person or organization. So the scammer is impersonating someone’s identity in order to deceive people.

The purpose of spoofing is to trick the victim into believing that an email, phone call, website, or IP address comes from a trustworthy person or organization. The main reasons criminals engage in spoofing are:

• Getting people to share personal information, such as bank details.
• Install malware on a device.
• Shutting down the computer system of a person or large organization.

Almost everyone has had to deal with phishing at some point. For example, you receive an email from a telecom provider about an outstanding payment. It contains a link to transfer an amount as quickly as possible to a specific account number. Or a field where you have to enter your username and password. So the scammer is fishing for your data. Learn more about this type of scam in the “Everything you need to know about phishing” article.

The fact that phishing emails are often very convincing is due to spoofing. The scammer has created an email address that resembles the real email address of the telecom provider. Moreover, he has precisely copied the logo and the layout of real mails. And via a link in the e-mail you will arrive at a website that looks exactly like that of the real telecom company. So the scammer takes on a different identity to deceive you. Spoofing can complement phishing.

There are different forms of spoofing.

Email Spoofing

In this form, a scammer uses a fake email address, which often closely resembles the real email address of the person or organization.

Website spoofing

The scammer has counterfeited an organization’s website. This usually asks for personal information. Counterfeit websites are often shared via a spoofing email.

Phone number spoofing

Scammers use a fake phone number to do this. For example, they call with a Dutch number, while in reality they are abroad. Or you will see a name appear on the screen, such as ‘Helpdesk Microsoft’ or ‘Customer Service ING’. While in fact a scammer is calling. Spoofing can also be used in whaling: a scammer pretends to be someone you know and then asks for money. Read more about this in the article ‘Don’t fall for whaling’.

IP address spoofing

A scammer takes over someone else’s IP address. This doesn’t happen often. If it happens, it is usually at (large) organizations.

Recognizing spoofing is difficult. A scammer tries to imitate a real person or organization as best as possible. The tips below will help you identify spoofing.

• In email spoofing
  Always check the email address if you do not trust an email. Have you received emails from that sender before and does the email address match? Also check if there are language errors or crazy sentences in the email. If there is a logo in the email, check whether it corresponds to that of the real organization. Also see where the links lead by moving the mouse over it
• In website spoofing
  Check the URL of the website. For example, in the browser, go to the website you know by manually typing the address. Read more about this in the article ‘Recognize a fake website’.

• With phone number spoofing
  Does an employee of an organization ask for personal information, such as a password or PIN? Then hang up, look up the organization’s number on the Internet, and call to see if they actually contacted you. If an acquaintance says that he or she has a new telephone number, contact the real acquaintance via the old telephone number or call the new one to hear his or her voice. Read more in the article ‘How do I recognize a fake phone call?’.