Recently someone asked me whether an email she received was spam. It seemed to be from a well-known bank (Belfius.be) in Belgium. It stated that some information was outdated and that it needed revision. Of course, the first thing that comes to mind is that it is spam. Why?

• Loads of errors in language, bad sentences .
• The link that was provided was an evil link: it appeared as if it led to the website of belfius (something like ). But when hovering over it, you could see that it actually referred to a completely other website. A .ca domain even.

Now, I immediately said Don’t you click on that link but something made me wonder. The sender’s email was [email protected] and belfius.be is the official website of the bank. So, how can this be? How can they fake their emailaddress?

2 Answers 2

Simple. By editing the From: header while sending the mail. This is known as “Email spoofing”. The From: header is easily editable if you’re sending the mail via PHP or something, no fancy tricks required. What is not editable, though is the IP address/domain name of the site from which it originated. If you check the plaintext email (in Gmail, go to the menu next to the reply button, and “show original message”), the Received: headers carries all the information about its path (The deeper down the Received: header is, the further back in the email chain it is). Note that an email passing through multiple hops can have some of the deeper headers spoofed as well. You need to go downwards, seeing which headers (i.e. sites) you trust. Each header will say something like Received: from abc.com (IP address) by something.google.com (IP) (assuming you have Gmail — otherwise the by will be different). Now, this header was written by the by part. Start at the top, the first few Received: headers won’t have a from / by . Find the first one with those. Its by will be belonging to your email provider — which you trust. See if you trust the from , and if you do, go on to the next Received: header (which you now trust), and so on. If you don’t trust a header in between, all the ones below it cannot be trusted — those may have been spoofed.

Gmail generally detects spoofing, though, and puts a “[email protected] via [email protected]” sort of hatnote on the email. Note that there are perfectly legitimate uses of email spoofing — many mailing lists spoof emails for a smoother experience. So do certain fora/message boards. Here, they send the email to make it look like it came from the original poster. The Reply-To: header is set to the list/webapp/whatever email id, so replying to it will by default go to the list(/etc). The list can then deal with it as it sees fit — it can check for spam, maybe put on hold for moderation, etc. When it wants to send it, it will spoof your address and send it to everyone on the list (which is exactly what you wanted — to be able to have email-based discussions without using “Reply to All” and keeping a list of contacts to copy-paste).

What some “legitimate” spoofers do is that they set the Sender: header to their own id. This is supposed to mean “Sent by Sender on behalf of From “. Note that the presence of a Sender: header doesn’t mean anything when it comes to “illegitimate” spoofing — that header is spoofable as well. Like I said, the only way to check is via the Received headers.

@chrisbhoffman
September 28, 2016, 10:47am EDT

Consider this a public service announcement: Scammers can forge email addresses. Your email program may say a message is from a certain email address, but it may be from another address entirely.

Email protocols don’t verify addresses are legitimate — scammers, phishers, and other malicious individuals exploit this weakness in the system. You can examine a suspicious email’s headers to see if its address was forged.

How Email Works

Your email software displays who an email is from in the “From” field. However, no verification is actually performed – your email software has no way of knowing if an email is actually from who it says it’s from. Each email includes a “From” header, which can be forged – for example, any scammer could send you an email that appears to be from [email protected] Your email client would tell you this is an email from Bill Gates, but it has no way of actually checking.

Emails with forged addresses may appear to be from your bank or another legitimate business. They’ll often ask you for sensitive information such as your credit card information or social security number, perhaps after clicking a link that leads to a phishing site designed to look like a legitimate website.

Think of an email’s “From” field as the digital equivalent of the return address printed on envelopes you receive in the mail. Generally, people put an accurate return address on mail. However, anyone can write anything they like in the return address field – the postal service doesn’t verify that a letter is actually from the return address printed on it.

When SMTP (simple mail transfer protocol) was designed in the 1980s for use by academia and government agencies, verification of senders was not a concern.