Phishing and Spoofing: How to Identify the Most Common Email Attacks

Every day, more than 300 billion emails are sent worldwide — and a growing share are fraudulent.
The most frequent threats are phishing and spoofing: attacks that trick users by pretending to be legitimate messages, aiming to steal information or money.

Understanding how they work and how to recognize them is essential to avoid becoming a victim.

What is phishing

Phishing is a type of online scam in which attackers send fake messages impersonating banks, companies, or trusted services to steal credentials, personal data, or financial information.

These emails often include malicious links or attachments and use urgent or alarming language, such as:

• “Your account will be blocked if you don’t verify your details.”
• “You’ve received a package. Confirm your delivery address.”

The word phishing comes from fishing, referring to how attackers “cast a wide net” to catch victims through deceptive emails.

What is spoofing

Spoofing is a technique used to forge the sender’s identity, making the recipient believe the email comes from a trusted source.

Attackers manipulate the “From” field or SMTP headers so that the message appears to come, for example, from support@yourcompany.com.

It is often used in mass phishing or targeted attacks (spear phishing), where the attacker personalizes the message to increase credibility.

Differences between phishing and spoofing

Although often confused, they are distinct techniques:

Both techniques are frequently combined in more sophisticated attacks.

How to spot phishing or spoofing attempts

Recognizing warning signs is the best defense.
Here are the most common indicators:

1. Suspicious sender address
   Check if the domain looks strange (info@banc0.com instead of info@bank.com).

2. Spelling or formatting errors
   Attackers often make grammar mistakes or use poor-quality logos.

3. Suspicious links
   Hover over the link (without clicking): if it points to a different or unknown URL, it’s likely fraudulent.

4. Urgency or threat
   “Respond within 24 hours or your account will be suspended” — a classic phishing tactic.

5. Requests for personal information
   No legitimate company will ask for passwords or sensitive data by email.

6. Unexpected attachments
   Avoid opening ZIP, PDF, or DOC files from unknown senders.

How to protect yourself from phishing and spoofing

Both individuals and organizations can take simple yet effective measures:

• Always verify the source before replying or clicking any link.
• Enable two-factor authentication (2FA) on all important accounts.
• Properly configure SPF, DKIM, and DMARC records on your domain to prevent impersonation.
• Use trusted communication services, such as registered email or registered SMS from eEvidence.
• Educate your team: awareness is the best first line of defense.
• Keep your software and antivirus updated to block known exploits.

Frequently Asked Questions (FAQ)

What should I do if I clicked on a phishing link?

Immediately change your passwords, disconnect your device from the Internet, and contact your bank or affected service provider.

How can I tell if someone is spoofing my domain?

Check your DMARC reports or use email header analysis tools to verify if your domain is being forged.

Can eEvidence emails be spoofed?

No. eEvidence implements SPF, DKIM, and DMARC authentication to ensure sender identity and protect recipients from impersonation.

Does registered email help prevent phishing?

Yes. registered email from eEvidence provides authenticity, traceability, and verifiable proof of message content and delivery, reducing the risk of tampering or impersonation.

Conclusion

Phishing and spoofing remain two of the most common and dangerous online threats. Both exploit user trust and distraction — but can be prevented through awareness and secure communication practices.

Implementing authentication protocols, staying alert, and using trusted services like eEvidence’s registered email and registered SMS are key steps to reduce risk and protect your digital communications.