Spoofing is a technique; phishing is an attack. Spoofing falsifies an identifier, such as a sender address, a caller ID or a domain name. Phishing is the deceptive request that spoofing makes credible. Almost all phishing involves spoofing of some kind, but spoofing on its own is not the attack.
Spoofing answers the question of why the message looked legitimate. Phishing answers what the message asked the victim to do. They are layers of the same event rather than competing categories.
This matters for defence, because the two are stopped by different controls. Spoofing is partly an authentication problem with technical fixes. Phishing is a decision problem, and needs a verification step in the process.
Documented cases
- The Seagate W-2 breach of 2016 turned on a spoofed email appearing to come from the chief executive, requesting employee tax records. The spoof supplied the authority; the phish supplied the ask.
- The iSpoof prosecution of 2022 is the cleanest illustration of spoofing sold as a service. The platform let subscribers set any caller ID they wanted, and it was used against tens of thousands of victims before it was taken down.
- The Crelan Bank fraud of 2016 cost $75.8M and relied on an executive identity the recipient had no way to authenticate from the message itself.
The control that breaks it
- For email, enforce SPF, DKIM and DMARC so that unauthenticated mail claiming your domain is rejected rather than delivered.
- For voice, accept that caller ID cannot be trusted at all and require a callback to an independently sourced number.
- For anything that moves money, dual authorisation removes the single point at which a convincing identity is enough.
Related
Social Engineering Examples