4 ms·
What about the sending and reply-to address? If the account is actually compromised at a system level, that is an IT issue. Again, are people so trusting that t
by Endy 7y ago
What about the sending and reply-to address? If the account is actually compromised at a system level, that is an IT issue. Again, are people so trusting that they don't check when asked for confidential data?
- kaffeemitsahne 7y agoSending addresses can be spoofed.
- sh-run 7y agoEnd users should never see emails that fail DKIM or SPF checks. Sender address spoofing is a solved problem. If a company gets owned because they failed to implement SPF or DKIM properly, IT is at fault, not the employee.
- jkeuhlen 7y agoBut wouldn't you reply to the address it specified instead of the source of the spoofing? I thought that was why most phishing emails include a link rather than asking you to reply.
- bluGill 7y agoFrom and reply-to looks just like your company unless you catch the misspelling. "l" and "I" in the domain name go to different companies, but when everything else in the email looks just like any other email from IT you aren't going to notice that small difference - you probably won't even read the from/reply lines.
- the_snooze 7y agoThe address doesn't matter in some of these scams. It could be a message spoofed from your boss's real email address saying, "Hey Sam, I sent you the wrong account we need to wire money to. It's actually 123456. Can you fix that ASAP? Thanks!"