Spoofing is evolving into a trust and identity problem

At a glance

What this is: GlobalSign argues that spoofing has evolved from simple message deception into a broader trust and identity problem spanning email, DNS, and AI-assisted impersonation.

Why it matters: It matters because email authentication, domain trust, and user verification now sit inside the same governance problem, which affects IAM, fraud prevention, and incident response.

Context

Spoofing is a deception problem that exploits trust assumptions in channels people and systems already rely on. In this article's framing, the core weakness is not only bad messages but weak assurance that the sender, domain, or request is genuinely authorised.

For identity and access teams, the intersection is real: spoofed email and fraudulent DNS redirection can be the front door to account takeover, payment diversion, and delegated access abuse. That makes spoofing relevant to human identity governance, mailbox security, and the trust controls around external communications.

Key questions

Q: What breaks when attackers hijack trusted email accounts instead of spoofing domains?

A: Sender authentication still works, but it no longer protects the user from abuse of a legitimate identity. The attacker inherits thread context, recipient trust, and an authenticated sending path, which makes malicious messages look like normal business communication. That is why organisations need identity-aware detection and rapid containment, not just stronger mail filtering.

Q: Why do MFA spoofing attacks still succeed even when two-factor authentication is enabled?

A: MFA spoofing succeeds because attackers target the human step in the process. If a user can be tricked into sharing a one-time password, or malware can intercept SMS messages, the second factor no longer protects the account. This is why OTP-based controls are weaker than phishing-resistant authentication and why delivery channel security matters.

Q: What are the signs that location spoofing controls are failing in practice?

A: Common signs include mismatches between IP location and browser time zone, system language, keyboard layout, or network behavior. WebRTC leaks, suspicious DNS routing, and repeated access from known anonymous infrastructure also indicate weakness. When these signals appear but are not investigated, restricted users can slip through while legitimate users may be blocked by overbroad rules.

Q: How should security teams reduce spoofing risk in email and voice workflows?

A: Security teams should validate identity at the protocol edge, not rely on what the user sees in the interface. For email that means SPF, DKIM and DMARC, and for voice it means carrier and boundary checks on caller identity. High-risk actions should always require an independent verification channel.

Technical breakdown

How spoofing turns trust into an attack surface

Spoofing works by imitating a trusted source closely enough that recipients accept the message, route, or request as legitimate. In email, that means forged sender identity and brand cues; in DNS, it means redirecting users before they reach the real destination; in voice or SMS, it means exploiting familiar channels to bypass suspicion. The technique succeeds because the attacker does not need to break encryption or compromise a platform first. They only need to make the trust decision happen in the wrong place, at the wrong time, under the wrong assumptions.

Practical implication: treat sender, domain, and destination trust as explicit controls rather than user judgement calls.

Why AI increases spoofing success rates

AI changes spoofing from crude imitation to adaptive impersonation. Synthetic voices, deepfakes, and generative text let attackers produce messages that match role, tone, and context far better than older phishing kits could. The article also points to automated tailoring, where public data and behavioural clues are used to shape attacks for a specific person or function. That pushes spoofing beyond volume into precision, which is why traditional filter logic and one-time awareness training are no longer sufficient on their own.

Practical implication: add behavioural and verification controls that catch contextually convincing impersonation, not just malformed spam.

Where email authenticity standards still matter

SPF, DKIM, and DMARC are designed to prove whether a message came from an authorised sending source and whether it was altered in transit. They do not solve every impersonation path, but they reduce one of the most common forms of email spoofing by giving receiving systems policy signals about sender legitimacy. When paired with DNSSEC, MFA, and clear incident-reporting paths, they help move spoofing defence from inbox filtering toward governed authenticity checks across the delivery chain.

Practical implication: enforce domain authentication and failure policy before relying on human reviewers to catch spoofed mail.

Threat narrative

Attacker objective: The attacker wants to turn trusted communication into unauthorised access, diverted payments, or fraudulent action without triggering suspicion.

1. Entry begins with a spoofed email, fake website, or falsified DNS response that presents as a trusted source.
2. Credential harvesting or redirection follows when the target is persuaded to enter credentials, approve a payment, or visit a malicious destination.
3. Impact appears as BEC, identity fraud, malware delivery, or business disruption once the trust decision has been abused.

Breaches seen in the wild

• Microsoft verified publisher OAuth phishing 2022: Malicious OAuth apps with a fraudulently obtained Microsoft verified publisher badge tricked UK users into granting mailbox access in 2022.
• Arup deepfake fraud 2024: Deepfakes of Arup's CFO and colleagues on a video call led a Hong Kong employee to transfer HK$200 million (about US$25.6m) to fraudsters.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Spoofing is now an identity governance problem, not just a messaging problem. The article's strongest point is that attackers increasingly win by borrowing legitimacy across channels, then using that legitimacy to drive fraud or access. That means the control boundary is no longer confined to email security teams; it extends into identity verification, domain trust, and the human decision points where authority is accepted. Practitioners should treat spoofing as a cross-domain assurance failure, not a mail hygiene issue.

Email authenticity controls are necessary but insufficient without trust workflow governance. SPF, DKIM, and DMARC can confirm authorised sending, but they do not validate the business context of a request. A spoofed invoice, a forged executive escalation, or a fake vendor callback can still bypass technical checks if the organisation has weak payment approval, callback, or mailbox verification workflows. The practical lesson is that trust controls must exist where work happens, not only where messages land.

AI has created a verification trust gap that old awareness programmes cannot close. Deepfakes and synthetic text increase the realism of impersonation faster than users can be trained to spot it reliably. That shifts the burden toward stronger authentication of high-risk actions, pre-agreed verification paths, and tighter linkage between communication channels and identity assurance. The governing concept here is clear: when imitation becomes cheap, verification must become procedural, not intuitive.

Shielded sender trust is the concept this article brings into focus. Organisations often assume that branded communications, familiar domains, and routine workflows are enough to establish trust. Spoofing shows that those signals can be manufactured, borrowed, or replayed. The implication for practitioners is to separate visual familiarity from actual authority and design controls that verify the actor behind the message.

Hybrid trust failures increasingly sit at the boundary between IAM and fraud operations. Spoofing can begin as an email problem and end as account takeover, payment diversion, or domain abuse, which means remediation ownership is shared. Security teams need a common operating model that links email authentication, identity assurance, fraud monitoring, and incident escalation. The practical conclusion is that spoofing defence fails when teams treat trust as someone else's domain.

What this signals

Verifiable trust is the real control objective. Spoofing shows that organisations cannot rely on appearance, familiarity, or channel conventions to establish authority. The practical shift is toward explicit verification at the point of action, especially for payments, mailbox changes, and vendor communications.

Because AI makes impersonation more convincing, organisations need procedural checks that outlast user intuition. That means tighter approval paths, stronger sender authentication, and response workflows that connect email security to identity and fraud operations.

For practitioners

• Harden domain authentication Enforce SPF, DKIM, and DMARC with a policy that rejects unauthorised mail, then review alignment for all external domains that send on behalf of the organisation.
• Add high-risk verification steps Require callback, secondary approval, or out-of-band confirmation for payments, mailbox changes, and executive requests that arrive through email or chat.
• Use DNSSEC where redirection risk matters Protect critical domains with DNSSEC and monitor for resolver or zone tampering that could redirect users to spoofed destinations.
• Run spoofing-specific awareness drills Test staff with realistic spoofed invoice, vendor, and executive scenarios so they practise reporting and verification rather than just spotting suspicious wording.
• Link fraud and identity escalation paths Route spoofing reports into identity, email, and fraud response workflows so suspected impersonation can trigger account, payment, and domain checks together.

Key takeaways

• Spoofing exploits trust assumptions across email, DNS, and social channels, which makes it a governance problem as much as a technical one.
• AI-assisted impersonation increases the realism and scale of spoofing, especially when attackers can tailor messages to roles and behaviours.
• Organisations need layered verification, domain authentication, and fraud escalation paths that stop deceptive requests before they become business actions.

Key terms

• Spoofing: Spoofing is the deliberate falsification of an identity signal such as a caller ID, email sender, or IP source address. The attacker is not necessarily stealing a credential. Instead, they are manipulating the signal that another system or person uses to decide whether to trust the interaction.
• Email Authentication: Email authentication is the set of controls that help recipients verify whether a message really came from a domain. SPF, DKIM, and DMARC reduce spoofing and impersonation, but they work best when combined with domain lifecycle management and user awareness.
• Business email compromise: A form of social engineering where an attacker impersonates a trusted person or domain to manipulate payment, change banking details, or extract sensitive information. It often succeeds without malware because the attacker targets process trust and human judgement instead of technical controls.
• DNS Spoofing: DNS spoofing is the manipulation of name resolution so a victim is sent to a fake destination instead of the intended service. In identity security, it matters because users may trust the right brand while unknowingly sending credentials or tokens to an attacker-controlled endpoint.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, IAM, and secrets management. It helps practitioners connect identity controls to the broader security programme their organisation depends on.