Email Spoofing

Email spoofing is a very common and convincing email scam which is used for a variety of reasons. For example, you may have received emails in the past which appeared to come from people you know or organizations you do business with. These malicious and friendly looking emails are intended to market a product, extract information or steal money from less suspecting individuals. Email spoofing usually has victims on both ends of the scam. First, those who receive the fraudulent emails are lured into giving away their information or money and second, those individuals or organizations whose emails have been spoofed to gain the trust of their friends or clients also have to defend themselves in an effort to control damage inflicted upon their reputation, although I personally think that damage resulting with high quality email scams using spoofed emails is never one hundred percent recoverable.

My Yahoo email account has been spoofed to send unauthorized emails to various people twice already, once in January 2010 and again in April 2012. Surprisingly enough, I had received a similar spoofed Yahoo email from a friend in April 2012, one day before my own Yahoo email account was spoofed which I immediately recognized as a spoofed email and notified the person. It’s interesting to note that many of these spoofed emails are Yahoo email accounts but after further investigation, I noticed that other email services such as Google Mail also suffer from email spoofing. Most people refer to these spoofed accounts as hacked accounts but the term email hacking means that someone gained access to a Yahoo email account through an ID and password. In cases when someone gains access to an email account to send unauthorized emails, a trail is left behind such as a copy of sent emails is stored in the sent folder. However, in cases of spoofed emails, there is no trail left in the sent folder because a common program is used to steal email addresses and send unsolicited emails.

How is Email Spoofing Done

For email spoofing to be successfully executed, two things must occur. First, the email addresses of the sender and the recipients must be collected to send the emails, and second, emails must be sent without ever logging into the email account of the spoofed email address owner. To understand how an email can be sent without ever logging into an email account, we need to discuss the Simple Mail Transfer Protocol or SMTP which is a technical protocol that enables data transfer between two systems. SMTP is an old set of rules for transferring e-mail messages used by email programs such as Outlook and others and many new Internet worms have built in SMTP engines that can bypass existing email programs completely. Such worms have everything they need to collect email addresses and establish a connection with a mail server to send emails to any and all email addresses the worm has collected from the infected computer. In other words, the worm takes over a computer to collect and send emails rather than take over an email account which makes it harder for the owner of an infected computer to detect the presence of a propagating worm.

Common Email Scams

Some of the common email scams committed using email spoofing include phishing scams to collect information, jury duty scams, lottery scams, tax refund scams, Nigerian scams and other financial scams promising money, business deals, jobs or prizes in exchange for donations, advanced payments or information, a click to a website link to complete an application which results in information theft, or purely a website click to buy products. Of course these scams would be less successful if the emails were not spoofed to appear coming from a trusted friend or company.

How to Identify Email Scams

There are so many email scams going around that most of us have come face to face with cases of email spoofing and scams either as a receiving victim of the email hoax or the owner of the spoofed email address. Most email hoaxes are easy to detect especially when they appear to be asking for something in exchange for some future reward, or coming from people or companies with a message that could not be possibly be coming from these entities. When you face such email scams, it is very easy to follow up with the sender to validate their intention. The best way to contact them is by obtaining their contact information from independent sources if not already available. This will make sure you are not contacting the scammer who will even try harder to get what he or she is looking for. Most importantly, if you receive and detect spoofed emails which appear to be coming from friends and acquaintances, notify them so that they can take the steps to contain the damage inflicted to their reputation.

Visit Identity Management Institute for education, training, and certification.