Lesson 5 of 14

Why the sender is no proof

How an email reaches you, why senders can be forged and why even a genuine address is not enough.

Chapter C · The inbox

Now you open your inbox. The first and most important insight: you cannot be sure who is writing to you. That is down to the technology itself.

Why the sender is no proof

Email was built for exchange, not for security

The protocol used to send emails (SMTP) dates from 1982. Back then, the point was to exchange messages at all. The sender simply enters the sender address themselves, just as you can write any return address you like on an envelope.

Email was built for exchange, not for security

ℹ️ Good to know

How easy is it? With a simple text tool you connect to a mail server and type a few commands: sender (MAIL FROM), recipient (RCPT TO), text (DATA). And there is an email with a made-up sender. Modern checking methods (SPF, DKIM, DMARC) make this harder, but not every business has set them up consistently, and they do nothing at all against the following tricks.

Why the sender is no proof

Email was built for exchange, not for security (continued)

The spam filter does not catch everything either. If it is too strict, genuine emails disappear; if it is too lax, phishing gets through. The better a phishing email is made, the more likely it is to reach you. The last check is you.

Why the sender is no proof

Four ways to fake a sender

Only the display name is fake. "Thomas Krämer" is displayed, but behind it is any free address. On a smartphone you often only see the name.
A similar domain. secureit-icu.de instead of secureit.icu, rn instead of m, a 0 instead of o, or an extra word such as -invoice or -support. Anyone can register domains like these for a few euros.
A forged sender by technical means, as described above.
A genuine, hijacked mailbox. The mailbox of a supplier or customer has been taken over. The email really comes from there, often as a reply in a genuine conversation with all the previous messages. This is the most dangerous form.

Four ways to fake a sender

★ Remember

The displayed sender is no proof. Not even a truly genuine address is, because the mailbox behind it may have been taken over. What matters is whether the content and the request fit the sender and the usual procedure.

Why the sender is no proof

Help your inbox gives you

Many businesses mark emails from outside with a note such as [EXTERNAL]. If this note appears on an email "from a colleague" or "from management", that is a clear warning sign.
Click or tap on the sender's name to see the full address.

Help your inbox gives you

💡 Practical tip

An email is more like a postcard than a sealed letter: sender and content can be forged, read along the way and even changed. With this picture in mind, you will almost always make the right decision.

Quiz question · Join in

A supplier writes in a genuine, ongoing email conversation that their bank details have changed. The sender address is exactly right. What applies?

Even a genuine address is no proof; the mailbox could have been taken over
The change is confirmed via the known phone number before any payment
The address is correct, so everything is fine
To be safe, reply to the email and ask

No answers yet.

Scan and join in

0 answers

Try it with your phone. All visitors share this demo; it starts empty again every night.

Sample · lesson 5 of 14

That was the sample.

The full course “Security at Work in the Office” has 14 lessons like this.

Open lesson for reading Go to the course