Fake Email: How to Spot, Report, and Stop It

In 2023, the FBI's Internet Crime Complaint Center reported that business email compromise — a sophisticated category of fake email — caused adjusted losses exceeding $2.9 billion in a single year. That wasn't from exotic zero-day exploits. It was from emails that looked real but weren't. I've investigated incidents where a single convincing fake email drained a company's operating account in under four hours.

This post breaks down exactly how fake emails work, how to identify them before they do damage, and what practical defenses actually stop them. Whether you're protecting yourself or an entire organization, the techniques here are the ones that matter.

What Makes a Fake Email So Dangerous?

A fake email is any message designed to impersonate a trusted sender — a bank, a boss, a vendor, a government agency — to trick the recipient into taking an action they otherwise wouldn't. That action is usually clicking a malicious link, opening a weaponized attachment, or wiring money to a threat actor's account.

The reason these emails work isn't technical sophistication. It's psychological precision. Attackers exploit urgency, authority, and trust. They send a message at 4:47 PM on a Friday that looks like it's from the CFO, requesting an "urgent" wire transfer. The employee, eager to wrap up the week, complies.

I've seen this pattern dozens of times. The technical barrier to sending a convincing fake email is shockingly low. Spoofing tools are available to anyone with an internet connection. The real defense isn't just technology — it's trained humans.

The Anatomy of a Fake Email: What Attackers Actually Do

Display Name Spoofing

This is the simplest and most common trick. The attacker sets the "From" display name to something like "Microsoft Support" or "John Smith - CEO" while the actual email address behind it is something like [email protected]. Most email clients on mobile devices only show the display name, not the full address. That's exactly what attackers count on.

Domain Lookalikes

Instead of spoofing, some threat actors register domains that look nearly identical to the target's real domain. Think yourcompany.co instead of yourcompany.com, or yourc0mpany.com with a zero replacing the letter "o." These pass casual inspection and even fool some automated filters.

Compromised Legitimate Accounts

The most dangerous fake emails aren't faked at all — they come from real accounts that have been compromised through credential theft. The attacker logs into a vendor's actual email, reviews past invoices, and sends a new one with updated bank details. Because the email comes from a legitimate address with legitimate history, it sails past every technical filter.

Payload Delivery

Once the recipient trusts the message, the payload arrives in several forms: a link to a credential harvesting page, a malware-laden attachment disguised as a PDF invoice, or instructions to take a specific action like changing payroll direct deposit information. The Verizon 2024 Data Breach Investigations Report found that phishing and pretexting accounted for the vast majority of social engineering incidents.

How to Identify a Fake Email: 7 Concrete Checks

Here's my field-tested checklist. I train organizations on this exact sequence because it catches the overwhelming majority of fake email attempts.

• Check the full sender address, not just the display name. On mobile, tap the name to reveal the actual address. If the domain doesn't match the supposed sender's organization exactly, stop.
• Hover over every link before clicking. On desktop, hover your mouse over any hyperlink to see the destination URL. If it doesn't match the expected domain, it's almost certainly malicious.
• Look for urgency language. Phrases like "immediate action required," "your account will be suspended," or "respond within 24 hours" are social engineering pressure tactics.
• Scrutinize requests for money or credentials. No legitimate organization will ask you to wire money, buy gift cards, or enter your password via email.
• Check for generic greetings. "Dear Customer" or "Dear User" instead of your actual name is a red flag, though sophisticated attacks will use your real name.
• Examine attachments with suspicion. Unexpected attachments — especially .zip, .exe, .html, or macro-enabled Office files — should be treated as hostile until verified through a separate channel.
• Verify through a second channel. If an email requests a financial transaction or sensitive action, pick up the phone and call the sender at a known number. Not the number in the email — a number you already have on file.

What Is Business Email Compromise and How Does It Use Fake Email?

Business email compromise, or BEC, is the weaponized, high-dollar version of the fake email. The FBI defines BEC as a scam targeting businesses that regularly perform wire transfers, using compromised or spoofed email accounts to authorize fraudulent payments. The FBI IC3 2023 Annual Report consistently ranks BEC among the costliest cybercrime categories.

In my experience, BEC attacks follow a predictable lifecycle. First, the attacker conducts reconnaissance — often by compromising a lower-level employee's email or scraping LinkedIn for org chart details. Then they craft a fake email that perfectly mimics internal communication patterns. Finally, they strike during a window when verification is unlikely: end of quarter, holiday weeks, or during leadership travel.

The defense against BEC isn't a single tool. It's a layered approach combining email authentication, employee training, and financial controls. Every organization should require out-of-band verification for any payment instruction change, regardless of how legitimate the email appears.

Technical Defenses That Actually Block Fake Emails

SPF, DKIM, and DMARC

These three email authentication protocols work together to verify that incoming messages actually originate from the domain they claim to represent. SPF checks the sending server's IP against a domain's authorized list. DKIM verifies a cryptographic signature attached to the message. DMARC ties them together and tells receiving servers what to do with messages that fail — quarantine or reject them.

If your organization hasn't implemented DMARC with an enforcement policy, you're leaving the door wide open. CISA has mandated DMARC adoption for federal agencies and strongly encourages it for all organizations. I recommend enforcing a "reject" policy once you've confirmed your legitimate email sources are properly aligned.

Multi-Factor Authentication on Email Accounts

Credential theft is the gateway to the most dangerous fake emails — the ones sent from real, compromised accounts. Multi-factor authentication (MFA) is the single most effective control against account takeover. If an attacker phishes an employee's password but can't bypass MFA, the compromise stops there.

Deploy MFA on every email account. No exceptions for executives. In fact, executives should be the first accounts protected because they're the most impersonated and the most targeted.

Email Filtering and AI-Based Detection

Modern email security gateways use machine learning to detect anomalies: unusual sending patterns, first-time senders impersonating internal contacts, and links to newly registered domains. These tools aren't perfect, but they catch the bulk of commodity phishing. The key is tuning them aggressively and reviewing quarantine reports regularly.

The $4.88M Lesson Most Organizations Learn Too Late

IBM's Cost of a Data Breach Report 2024 put the global average cost of a data breach at $4.88 million. Phishing — which starts with a fake email — was among the most common initial attack vectors. The math is straightforward: investing in detection and training costs a fraction of what a single successful breach costs.

Yet I still walk into organizations where employees have never been through a structured phishing simulation. They've never seen a side-by-side comparison of a legitimate email and a fake one. They don't know what DMARC is. They click because nobody ever showed them what not to click.

That's a solvable problem. Structured cybersecurity awareness training gives your workforce the pattern recognition skills to catch fake emails before they cause damage. It's not a one-time event — it's an ongoing program that adapts to the evolving threat landscape.

Phishing Simulations: The Training That Changes Behavior

Reading about fake emails isn't enough. Your employees need to experience them in a controlled environment. Phishing simulations send realistic but harmless fake emails to your staff, track who clicks, and deliver immediate, targeted education to those who fall for it.

In my experience, organizations that run monthly phishing simulations see click rates drop from 30%+ to under 5% within six months. That's not theoretical — that's measurable risk reduction.

If you're looking to launch or improve your program, phishing awareness training designed for organizations provides the structure and realism needed to move the needle. The best programs rotate through different social engineering tactics — authority-based requests, urgency plays, credential harvesting pages, and attachment-based lures — so employees build broad pattern recognition rather than just learning to spot one type of fake email.

What to Do When You Receive a Fake Email

Knowing how to respond is just as important as knowing how to detect. Here's the protocol I recommend for every organization:

• Don't click anything. Don't open attachments, don't follow links, don't reply.
• Report it immediately. Use your organization's phishing report button or forward the message to your IT/security team. If you're an individual, forward phishing emails to the Anti-Phishing Working Group at [email protected] and to the FTC at reportfraud.ftc.gov.
• If you already clicked, act fast. Disconnect from the network, change your passwords immediately from a different device, enable MFA if it isn't already on, and contact your security team. Speed matters — ransomware can encrypt a network in minutes.
• Preserve the evidence. Don't delete the email. Your security team needs the full headers and any URLs or attachments for analysis and to update filtering rules.

Zero Trust and Fake Email: The Bigger Picture

Fake email doesn't exist in isolation. It's usually the first step in a larger attack chain — credential theft leading to lateral movement, data exfiltration, or ransomware deployment. That's why forward-thinking organizations are adopting a zero trust architecture: never trust, always verify, at every layer.

In a zero trust model, even if a fake email succeeds in compromising credentials, the damage is contained. Network segmentation limits lateral movement. Continuous authentication challenges suspicious sessions. Least-privilege access means a compromised user account can't reach crown jewel data.

Zero trust won't make fake emails disappear. But it shrinks the blast radius when one inevitably gets through. Combine it with strong email authentication, aggressive filtering, MFA, and continuous security awareness training, and you've built a defense that actually holds up.

The Bottom Line on Fake Email Defense

Every data breach investigation I've been involved with traces back to a moment where someone trusted something they shouldn't have. Usually, it was an email. The threat actors behind fake email campaigns are patient, creative, and persistent. They only need to succeed once.

Your defense needs to be equally persistent. Implement DMARC. Deploy MFA everywhere. Run phishing simulations regularly. Train your people — not once a year during compliance season, but continuously. Make reporting easy and consequence-light so employees flag suspicious messages instead of hiding mistakes.

The organizations that take fake email seriously aren't the ones that never get phished. They're the ones that catch it fast, contain it faster, and keep getting better at both.