The verb spoof means to make a joke or parody of something, but the modern connotation of the word is far more sinister. Today, the term usually refers to the act of forging credentials in order to approach a victim as someone else. Nearly every hacker, scammer, phisher or social engineer interacting with human targets is a “spoofer” of some sort. In other words, spoofing is integral to many of today’s most devastating scams. Spoofing isn’t new, though; it’s just forgery by another name, but with today’s technology, it’s become trivially easy to perform spoofing convincingly.

Given the ingenuity of scammers, the better question would probably be, “what can’t be spoofed?” Although there are many different types of credentials scammers can spoof to convince you that they’re someone they’re not, below we’ll go over the most common types of spoofing, detail how they’re usually used and explain how you can protect yourself from each type.

Email spoofing

What it is: Email spoofing specifically refers to the alteration of an email header (usually the from or sender field), so that an email appears convincing to a potential target. While someone with some technical expertise might be able to poke around a spoofed message to identify its exact origins, to the average person, the email will look legitimate, as phishers often use real email addresses in their forged headers. If the spoofer has done their research, the message will not only come from an email address their victim recognizes, but also the tone of the message will usually accurately emulate the sender they’re