Email Spoofing

Here’s a scenario I’ve dealt with more than once. A confused client calls asking why you sent them a weird invoice. You didn’t — a scammer did, using your domain. It looked like it came from you, and your client almost paid it.

The “From” field in an email is about as trustworthy as the return address on a letter. Anyone can write anything there. Email was built in an era when everyone on the internet trusted each other — SPF, DKIM, and DMARC were invented later to fix that. But they only work if you set them up.

Spoofing is automated and random — bots target domains, not people. Unused and secondary domains get hit too. The damage compounds: clients lose trust, your domain lands on blocklists, and your real emails start going to spam.

Check your exposure: run your domain through a free DMARC checker like EasyDMARC. If it’s already happening, warn your clients and report it through ReportCyber at cyber.gov.au.