Why the sender is no proof
How an email reaches you, why senders can be forged and why even a genuine address is not enough.
Email was built for exchange, not for security. Senders can be forged, display names chosen freely, domains registered to look deceptively similar. And sometimes the email really does come from a partner's hijacked mailbox, in the middle of a genuine conversation. The sender alone is no proof.
Chapter C · The inbox
Now you open your inbox. The first and most important insight: you cannot be sure who is writing to you. That is down to the technology itself.
Email was built for exchange, not for security
The protocol used to send emails (SMTP) dates from 1982. Back then, the point was to exchange messages at all. The sender simply enters the sender address themselves, just as you can write any return address you like on an envelope.
How easy is it? With a simple text tool you connect to a mail server and
type a few commands: sender (MAIL FROM), recipient (RCPT TO), text
(DATA). And there is an email with a made-up sender. Modern checking
methods (SPF, DKIM, DMARC) make this harder, but not every business has set
them up consistently, and they do nothing at all against the following
tricks.
The spam filter does not catch everything either. If it is too strict, genuine emails disappear; if it is too lax, phishing gets through. The better a phishing email is made, the more likely it is to reach you. The last check is you.
Four ways to fake a sender
- Only the display name is fake. "Thomas Krämer" is displayed, but behind it is any free address. On a smartphone you often only see the name.
- A similar domain.
secureit-icu.deinstead ofsecureit.icu,rninstead ofm, a0instead ofo, or an extra word such as-invoiceor-support. Anyone can register domains like these for a few euros. - A forged sender by technical means, as described above.
- A genuine, hijacked mailbox. The mailbox of a supplier or customer has been taken over. The email really comes from there, often as a reply in a genuine conversation with all the previous messages. This is the most dangerous form.
The displayed sender is no proof. Not even a truly genuine address is, because the mailbox behind it may have been taken over. What matters is whether the content and the request fit the sender and the usual procedure.
Help your inbox gives you
- Many businesses mark emails from outside with a note such as [EXTERNAL]. If this note appears on an email "from a colleague" or "from management", that is a clear warning sign.
- Click or tap on the sender's name to see the full address.
An email is more like a postcard than a sealed letter: sender and content can be forged, read along the way and even changed. With this picture in mind, you will almost always make the right decision.
A supplier writes in a genuine, ongoing email conversation that their bank details have changed. The sender address is exactly right. What applies?
More than one answer may be correct.
Hijacked mailboxes reply in genuine conversations. A reply to the email goes to the attacker. Only a second, known channel provides certainty; more on this in Chapter D.