Email spoofing: how to tell if an email really comes from the sender
A spoofed email shows a sender name and address you trust, but someone else sent it. How an email looks is not enough to judge it.
On this page6 sections
A spoofed email shows a sender name and address you trust, but someone else sent it. How an email looks is not enough to judge it. Knowing how to verify an email is legitimate comes down to one habit: before you pay, reply or share details, confirm the request with the sender through a contact you found yourself.
In short: a spoofed email borrows a trusted name and address. Judge it by what it asks you to do, and do not act on a request for money, bank details or personal information until the sender has confirmed it.
What is a spoofed email?
Email spoofing and phishing: what is the difference?
Warning signs that an email is not from the sender it shows
How to verify an email is legitimate: steps you can take today
How to stop someone spoofing your business email
Where an Authentikor check fits
What is a spoofed email?
A spoofed email is a message that shows the name and address of someone you know or trust, but that person did not send it. Until you have checked, it is safest to treat it as a message from someone you do not know.
Treat a familiar name at the top of an email as a label, not as proof of who sent it. Look closely at what the email asks you to do, such as pay, change a bank account, reply with information or open a link.
Email spoofing and phishing: what is the difference?
Put simply, spoofing is about who an email claims to be from, while phishing is about what an email tries to get you to do: hand over money, passwords or personal details, or open something harmful.
One email can be both at once. For the person receiving the email, the response is the same either way: check the request, not only the name at the top.
Warning signs that an email is not from the sender it shows
The clearest warning sign is a request that would cost you money or information if the sender were not who they claim to be. To tell if an email is legitimate, look at what it asks you to do as well as who it seems to come from.
Take extra care before acting on any email that asks you to pay into a new or changed bank account, asks you to act urgently or keep the request quiet, or asks for passwords, login codes or identity documents. Check too that the address matches the one you know exactly, that a reply would go to that same address, and that you were expecting any link or attachment.
No warning sign proves on its own that an email is fake, and a careful scam may show none of them. The steps below matter more than any one sign.
How to verify an email is legitimate: steps you can take today
The key step is a check with the sender that does not rely on anything in the email itself. Work through this checklist before you act.
Stop before you act. Do not pay, reply, click a link or open an attachment until you have checked.
Look at the full sender address, not only the display name, and compare it with an earlier email you know is genuine.
Check where your reply will go before you answer.
Phone the sender on a number you already have or found yourself, for example on an earlier invoice or contract. Do not use a number or link given in the email.
Treat any change to bank details as unconfirmed until the sender confirms it on that call.
If the email carries a verification code from its sender, check the code before you act.
If you are still unsure, ask a colleague or whoever looks after your IT to look at the email before anyone acts on it.
William Despard of the vendor CyberWin, in a TechForum piece issued by CyberWin and published on ITWeb on 30 September 2026, gives his own view that a callback should use a number sourced independently, not one supplied in the email you doubt.
How to stop someone spoofing your business email
The UK National Cyber Security Centre's email security and anti-spoofing guidance advises organisations to set up SPF, DKIM and DMARC on their domains to make spoofing harder. Google's Workspace admin help, in its page 'About authentication methods', also advises domain administrators to set up SPF, DKIM and DMARC to help protect their domain against spoofing. Ask whoever manages your domain and email to set up all three, using your own email provider's instructions.
These settings have a limit, though. In a TechForum piece issued by the cyber security distributor CyberWin and published on ITWeb, CyberWin's William Despard gives his own view, in a piece that promotes an email security platform: many fraudulent emails come from a real account that has been compromised and so pass SPF, DKIM and DMARC checks, which is why a callback on an independently sourced number still matters.
Codes that recipients can check add a further layer for a business, not a replacement for those settings: Authentikor's FAQ says a business can cancel or blacklist a code at any time, and a code can expire after a set time or a set number of checks.
Where an Authentikor check fits
An Authentikor check applies only to an email or document that carries an Authentikor code: Authentikor's home page says such a code can be checked by scanning its QR code or by typing the code into the Verify page on the Authentikor website. Authentikor's FAQ says the person checking does not need to install anything and checks the code in a web browser.
Authentikor's Verify page says a verified result means the code is valid and was issued by the company named in the result. The Verify page says a 'not recognised' result means the code could not be found, and that the reader should check it was typed correctly and, if it was, not trust the email or document. The Verify page says an expired result means the code was valid but its time is over, and that the reader should ask the sender to confirm in person or by phone. The Verify page says a blacklisted result means the issuer has withdrawn the code, and that the reader should not trust the email or document and should contact the sender on a number they already know.
For an email that carries an Authentikor code, Authentikor's FAQ says a scan shows what the code or seal was issued for, including the sender address and the recipients, masked; Authentikor's home page adds that a message from any other address does not match. Authentikor's home page says that if nothing is found, Authentikor has no seal or code to show for it, and that this never means the document is fake. Compare that result with the email in front of you only when that email carries a code. An email without a code can be neither confirmed nor ruled out by this check.
Questions and answers
What is a spoofed email?
A spoofed email is a message that shows the name and address of someone you know or trust, but that person did not send it. Until you have checked, it is safest to treat it as a message from someone you do not know.
How can I tell if an email is legitimate?
Look at what the email asks you to do as well as who it seems to come from. Take extra care with requests to pay into a new bank account, to act urgently or in secret, or to share passwords, login codes or identity documents. No single sign proves an email is fake, so confirm the request with the sender through a contact you already trust.
What is the difference between email spoofing and phishing?
Spoofing is about who an email claims to be from, while phishing is about what the email tries to get you to do: hand over money, passwords or personal details, or open something harmful.
How do I stop someone spoofing my business email?
The UK National Cyber Security Centre and Google's Workspace admin help both advise organisations to set up SPF, DKIM and DMARC on their domains, which makes spoofing harder. Ask whoever manages your domain and email to set up all three, using your own email provider's instructions.