Phishing vs spoofing gets muddled because you rarely see one without the other. Spoofing is the fake return address. Your phone says it’s the bank calling, the email says it’s from your boss, and neither is true. Phishing is the ask that comes next. Click here, sign in there, pay this.
Costume and con, if that helps. Most phishing has a bit of spoofing in it. But a phishing email can also come from a real account that got hacked, with nothing faked at all, and spoofed calls get used for plenty of scams that nobody would call phishing.
| Spoofing | Phishing | |
|---|---|---|
| What it is | Faking who a message or call appears to come from | A scam that tricks you into an action |
| The question it answers | Why did it look legitimate? | What did it ask you to do? |
| Examples | A forged sender address, a copied bank number on caller ID, a look-alike domain | “Send me the W-2 files”, “confirm your login”, “approve this payment” |
| Mostly fixed by | Technical checks: SPF, DKIM, DMARC, call authentication | Process: verifying requests through another channel |
| A case from this library | iSpoof (2022): a website that rented out banks’ phone numbers | Seagate (2016): a fake request that leaked staff tax forms |
Key takeaways
Picture a Monday-morning email, apparently from the CEO, wanting a spreadsheet before lunch. The display name says the CEO’s name, and maybe the address is forged or only one letter off. That’s the spoofing. The actual ask, plus the “before lunch” pressure, is the phishing.
It’s worth pulling them apart because they get stopped in different places. A lot of forged email never reaches anyone if the domain has proper authentication set up. A request that does get through still has to be caught by a person, or better, by a rule that says this kind of thing always gets checked.
iSpoof was a website run out of the UK. For somewhere between £150 and £5,000 a month, paid in Bitcoin, subscribers could make any number they liked appear on a victim’s phone, including the number printed on the back of their bank card. There were even add-on tools to grab the codes victims typed in during the call.
Prosecutors traced £43 million of UK fraud to it, and the judge at sentencing said a worldwide estimate of around £100 million was on the low side. That “200,000 victims” figure floating around? It counts people kept on the line for over a minute. Not people who lost money. In November 2022 police pulled the plug. The site’s administrator was later jailed for 13 years and 4 months. Full case: iSpoof caller ID spoofing.
At Seagate, around 1 March 2016, a phishing request reached staff who looked after payroll data, dressed up to look like it came from inside the company. They sent over 2015 W-2 forms for several thousand US employees, which meant names, home addresses, Social Security numbers and pay details all ended up with someone who shouldn’t have them. Full case: Seagate W-2 phishing.
Scale that up and you get cases like Crelan, a Belgian bank, where people pretending to be the CEO talked staff into a string of wire transfers. Internal controls flagged it in January 2016. By then close to EUR 70 million (about US$75.8 million) was gone.
Tip: a familiar name on the screen proves very little. Would you do this for a stranger? No? Then contact the real person, on details you already had, before doing anything.
There are more examples in the phishing case collection and the pretexting and impersonation cases.
No, though they overlap a lot. Spoofing is the faking part, like a forged sender or a fake number on caller ID. Phishing is the scam that uses it. Plenty of attacks have one but not the other.
The usual ones are email spoofing, where the sender is forged; caller ID spoofing, where a fake number shows on your phone; domain spoofing, where a web address looks almost right; and SMS spoofing, where a text seems to come from a known sender. They’re all ways of borrowing someone else’s trust.
Only one slice of it. DMARC stops email that forges your exact domain. It won’t help with look-alike domains, hacked real accounts, texts or calls. Worth having, but don’t treat it as the whole answer.
Yes, and it’s not hard. iSpoof sold it as a monthly plan. So if a call from your bank’s number asks for a code or a transfer, hang up and call the bank yourself.
Reviewed by the SEE Team on 22 October 2026; every case linked here has its sources on its own page. How pages are researched and fact-checked. About Social Engineering Examples.
Social Engineering Examples