What is “friendly name spoofing”?

Imagine you get an email that reads "Sarah Chen, CFO" <wire-transfer@quickmail.net>. But your inbox only shows you Sarah Chen, CFO. No domain. No red flag in sight. You wire the money. That's friendly name spoofing.

Friendly name spoofing means an attacker puts a convincing display name (like a CEO or finance director) into the "From" field while using a completely unrelated sending address. The display name is the part you see. The actual address is hidden behind it.

Here's why it's so effective. Your technical defenses, SPF, DKIM, and DMARC, all check the sending domain. If someone sends from a real Gmail account, that Gmail address passes every authentication check cleanly. DMARC has nothing to block because the sending domain is legitimate. It's just not the domain the display name is pretending to represent.

So your email security stack gives it a green light while your brain fills in the rest. "That's from Sarah" and you act on it. This is the core mechanic behind Business Email Compromise (BEC), one of the most financially damaging scams targeting companies today.

What actually helps against this?

• Train your team to click the display name and check the real address before taking any financial action or sharing sensitive data.
• Email security rules can flag messages where the display name matches an internal executive but the sending domain is external. Microsoft 365 and Google Workspace both support these kinds of impersonation detection policies.
• Out-of-band verification is your last line for anything high-stakes. If an email from "the CEO" asks you to do something unusual, call them. Don't reply to the email.

DMARC alone won't catch this (though it's still critical for stopping direct domain spoofing). Friendly name spoofing lives in the gap between technical authentication and human judgment. Closing that gap takes both good tooling and people who know what to look for.

Want to understand what your own authentication setup actually covers? Check your DMARC record with our free DMARC parser to see where you stand.