Have you ever opened a spam email that appeared to be from your own email? You're not alone.
Creating email addresses is called spoofing , it's usually for spam or blackmail purposes, and unfortunately, there's little you can do about it.
How spammers spoof your email
Spoofing is the act of forging an email address so that it appears to be from someone else, rather than the person who sent it. Often, this technique is used to trick you into thinking that the email came from someone you know, or from the company you work for, or from your bank or other financial service.
Unfortunately, email spoofing is incredibly easy. Email systems often don’t have a security check to ensure that the email address you type in the “From:” field actually belongs to you. It’s a bit like a letter you give to the post office. You can write anything you want in the “From:” field, as long as you don’t mind the post office not being able to return the letter to you. The post office has no way of knowing if you actually live at the address you put on the envelope.
Email spoofing works similarly. Some online services, like Outlook.com, pay attention to the “From:” address when you send an email, and that can prevent you from sending something with a fake address. However, some tools let you fill in whatever you want. It’s as easy as setting up your own email server (SMTP). What spammers need is your email address, which they can likely buy on the dark web from a data breach.
Why do scammers spoof your address?
Scammers send you emails that appear to come from your address, usually for one of two reasons. The first reason is that they hope to bypass spam protection. They assume that you are likely to send emails to yourself, perhaps to remind you of an important event, and you would not want this message to be marked as spam.
So, the scammers hope that by using your address, your spam filters won't stop their message and let it through. There are tools to detect an email message being sent from a domain other than the one it claims to be, but your email provider has to implement them, and unfortunately, many don't.
The second reason scammers spoof your email address is to gain a sense of authenticity. It’s not uncommon for a spoofed email to claim that your account is compromised. The fact that “you sent this email” serves as proof of the “hacker”’s access. They may also include a password or phone number taken from a compromised database as further proof.
The scammer usually claims to have “spicy” information about you or images taken by your camera while you were browsing adult websites. Then, they threaten to hand over the data to your closest contacts unless you pay a ransom. It sounds believable at first. And with yourself as the sender, it seems like they have access to your email account.
What are email services doing to address the problem?
The fact that someone can spoof an email address so easily is not a new problem. Because email providers don't want to bother you with spam, they've developed tools to combat the problem.
The first was the Sender Policy Framework , or SPF , and it works on a few basic principles. Each email domain is accompanied by a set of Domain Name System (DNS) records, which are used to direct traffic to the correct server or hosting computer. An SPF record works in conjunction with the DNS record.
You might be confused, so let's put it simply. When you send an email, the receiving service compares your email domain (e.g. @gmail.com) with the originating IP and SPF record to make sure they match. If you send an email from a Gmail address, that email should also show that it came from a Gmail-controlled device.
Unfortunately, SPF alone doesn't solve the problem. Someone has to properly maintain SPF records for each domain, which isn't always the case. It's also easy for scammers to get around this problem. When you receive an email, you might only see a name instead of an email address. Spammers also fill in one email address for the real name and another for the sending address that matches an SPF record. That way, it won't go to spam.
Companies also need to decide what to do with the SPF results. Most of the time, they would rather let all emails through than risk not delivering a critical message. SPF doesn't have a set of rules about what to do with the information.
To address these issues, Microsoft, Google, and other major companies introduced Domain-based Message Authentication, Reporting, and Conformance, or DMARC for short. It works with SPF to create rules for what to do with emails that are flagged as potential spam.
DMARC first checks the SPF scan. If the check fails, it doesn’t let the message through unless otherwise configured by an administrator. Even if an SPF passes, DMARC checks that the email address shown in the “From:” field matches the domain the email message originated from.
Unfortunately, even with support from Microsoft, Facebook, and Google, DMARC is still not widely used. If you have an Outlook.com or Gmail.com address, you probably benefit from DMARC. However, as of late 2017, only 39 of the Fortune 500 companies had implemented this validation service.
What can you do about spam emails coming from you?
Unfortunately, there is no way to prevent spammers from hijacking your address. Hopefully, the email system you use implements both SPF and DMARC and you won't see these targeted emails in your inbox. They should go straight to spam.
If your email account gives you control over its spam options, you can make the rules stricter. Just be aware that you may miss some genuine messages, so be sure to check your spam folder often.
If you get a fake message from yourself, ignore it. Don't click on any attachments or links, and of course don't pay the ransom demanded. Just mark it as spam or phishing, or delete it. If you're worried that your accounts have been compromised, close them for safety.
If you use the same password with other services, change them and give each service a new unique password. If you don't trust your memory with so many passwords, simply write them down in a txt file saved on your computer or use a password manager.
And finally, depending on which email service you use, learn how to view the entire original email, with all its details (headers, etc.), so you can determine whether it is spam or not.
