You check your email and find an odd-looking message1 from one of your friends. You read it, and it’s asking you to go to some strange web site2 or open an attachment. Hopefully, red flags go up at this point — you’re pretty certain your friend didn’t send this. To be safe, you ask him, and he has no idea what you’re talking about. He checks his “sent” folder, and there’s no sign of an email like that ever having been sent. Has his account been hacked? Probably not.It’s called “email spoofing” and there’s nothing complicated about it.
Picture this: you’re at your own house, and you grab a piece of paper and an envelope. You write “I QUIT!!!” and stuff it into the envelope and address it to our mutual boss. But for the return address, rather than putting your own name and address, you put MY name and address. And then you send the letter3.
Our boss receives your letter. He glances at the return address, see it’s from me, opens it up, and wonders a) why I’m quitting and b) why I’m so inconsiderate4.
Of course, I didn’t send it — you did. But since you put my name and address as the return address, it looks like I sent it. Sure, the postmark might give it away, but if it was sent from the city in which I live, there’s not much anyone can do to prove or disprove who actually sent it. Unless a crime has been committed and the FBI gets involved, Rob’s just going to have to believe me when I say I didn’t send it5.
It’s no different when it comes to email. People can send an email and put in any return address they want. It’s easy, and it happens all the time.
There are systems in place to help deter this and prevent it from happening, but like all human creations, it’s imperfect. Just know that for every spoofed email you see, there’s probably a thousand that were blocked that you will never see.
So, the next time someone says, “Duuuuude, I got a weird email from you. I think your account was hacked!”, by all means, double-check your sent items to make sure that you haven’t actually been hacked. And just as we do here at work, you should change your own passwords periodically as well. But the odds are, it’s just email spoofing. So don’t shoot the messenger — they might not even be the messenger!
Check out the email spoofing infographic here: http://goo.gl/isJqCF
1 Odder than usual
2 Stranger than usual
3 Please, don’t try this at home
4 And c) where should he hold the celebration?
5 Seriously, I didn’t send it!