Why this matters
Email was not designed to verify senders, so criminals can make a message appear to come from your boss, a supplier or even your own address. Spoofed emails are often used for payment fraud. Knowing how to check the sender protects you and your business.
What you'll need
- The suspicious email
- Outlook, Outlook on the web or Gmail
Step-by-step instructions
Step 1
Compare the display name and address
Spoofers often use a trusted display name with a different email address. Tap or hover on the name to reveal the real address.
Step 2
Look for lookalike domains
Check for subtle changes such as "omnicr0n.com.au", "omnicron-au.com" or extra words in the domain.
Step 3
Check the Reply-To address
Select Reply and look at the address that appears. A different domain is a strong sign of fraud.
Step 4
View the message headers
In Outlook on the web, open the message, select the three dots, then View, then "View message details". In Gmail, select the three dots and "Show original". Look for SPF, DKIM and DMARC results; "fail" or "softfail" is a warning sign.
Step 5
Watch for external sender tags
Many organisations add an "External" banner to emails from outside. An email "from your CEO" with that banner should be treated with caution.
Step 6
Verify by phone
If the request involves money, credentials or sensitive data, confirm by calling the person on a known number.
Summary
Checking the real address, the reply-to and the authentication results reveals most spoofed emails within seconds.
Still Need Help?
Some IT problems are easier to solve with a professional. If you've followed the guide and still need help, the Omnicron team can assist.