Spoofing

You log onto Instagram (or Facebook or TikTok or whatever your platform of choice is) and see that you have a new message. It’s from your celebrity crush, saying that they’ve found your profile, they think you seem amazing, and you two should grab a drink sometime. Your palms start to sweat as you double-check their name and profile photo, and yes, they still look as gorgeous as ever. As your brain kicks into overdrive thinking about how to respond, you notice one other strange detail... they only have six followers? Turns out, it was actually your friend who made a fake account to trick you for April Fool’s Day. 

You might feel a bit let down, but hopefully the prank was mostly funny. Now imagine that, instead of impersonating your celebrity crush, someone was pretending to be your bank, your boss, or your internet router. It’s not quite as funny, and the consequences of responding incorrectly are likely much higher. That’s the essence of spoofing: it’s all about faking identity to gain trust and cause trouble.

Spoofing is a deceptive cyber technique in which an attacker deliberately falsifies data or their identity to masquerade as a trusted source, often to gain unauthorized access to systems or to trick individuals into revealing sensitive information.¹ Spoofing can take many forms, such as email spoofing, IP spoofing, GPS spoofing, caller ID spoofing, and website spoofing—each involving the manipulation of communication protocols or visual cues to create a false sense of legitimacy. This tactic exploits both technical vulnerabilities and human cognitive biases, particularly our tendency to trust familiar or authoritative signals, making it a common precursor to more damaging attacks like phishing, malware delivery, or system infiltration.¹

It’s important to note that spoofing and phishing, although sometimes used interchangeably, are different concepts. Spoofing is when an attacker fakes their identity or source, like forging an email address, a caller ID, or a website to appear legitimate. Phishing goes a step further: it uses spoofing tactics to trick victims into providing personal info, like passwords or credit card numbers. In short, spoofing is often a tool used in phishing and hacking, but not all spoofing is phishing. For example, someone might spoof a website just to spread misinformation, not to steal data.