A foundational tag covering the basics of spoofing in cybersecurity. These articles define spoofing, explain its various forms including email, caller ID, DNS, and IP spoofing, and provide clear guidance on how to identify and defend against spoofed communications.
posts
In March 2025, the FBI's Internet Crime Complaint Center reported that spoofing-related fraud accounted for billions in losses across American businesses and individuals. Every major data breach investigation I've worked on in the past five years started the same way — someone trusted something that wasn'
In January 2024, a finance employee at engineering firm Arup wired $25 million to criminals after a video call with what appeared to be the company's CFO and several colleagues. Every person on that call was a deepfake. The attackers had spoofed not just an email address or
In March 2022, the FBI's Internet Crime Complaint Center reported that Business Email Compromise — a scheme built almost entirely on spoofing — cost victims over $2.4 billion in 2021 alone. That made it the single most financially devastating category of cybercrime they tracked. Not ransomware. Not cryptojacking. Spoofing-based
In July 2020, attackers spoofed internal Twitter tools to hijack 130 high-profile accounts — including Barack Obama, Elon Musk, and Apple — and ran a Bitcoin scam that netted over $100,000 in hours. The attack didn't rely on some exotic zero-day exploit. It relied on spoofing: making something fake
In 2023, the FBI's Internet Crime Complaint Center received over 298,000 complaints related to phishing and spoofing — making it the number one reported cybercrime category for the fifth year running. That wasn't a fluke. Spoofing is the backbone of almost every major social engineering campaign
