Spoofing
Spoofing is falsifying an identifier so that a system or a person accepts the sender as someone they are not. The identifier varies — an email address, a caller ID, an IP address, a website, a GPS position, a face — and the structure does not: something that is trusted because of what it claims to be is made to claim something false.
It is a family of attacks rather than one attack, and the reason the family exists is consistent. Most identifiers in everyday use were designed to be readable, not to be authenticated.
| What it is | Falsifying an identifier to impersonate a trusted source |
| Email spoofing | Forged sender address — SMTP has no native authentication |
| Caller ID spoofing | Forged calling number, exploited in vishing |
| Website spoofing | Lookalike domain and cloned design |
| IP and GPS spoofing | Falsified network origin or location |
| Biometric spoofing | A presentation attack against a face or fingerprint check |
The main types
Email spoofing forges the sender address. SMTP was designed without authentication, so the From field is simply text the sender writes. SPF, DKIM and DMARC were added to address this and they do help — they authenticate the domain, not the person, which is why a lookalike domain the attacker legitimately owns passes every check.
Caller ID spoofing falsifies the calling number. Telephone signaling was built on the assumption that only trusted carriers could originate traffic, which stopped being true. STIR/SHAKEN attests to a caller’s right to use a number, and its coverage is incomplete, particularly across international and legacy routes.
Website spoofing clones a site at a lookalike domain, often using characters that render almost identically to the real ones. The padlock proves the connection is encrypted and says nothing about who owns it.
IP and GPS spoofing falsify network origin and location — the first to evade reputation controls, the second to defeat geolocation checks.
Biometric spoofing, usually called a presentation attack, presents an artifact to a biometric sensor: a printed photograph, a face on a screen, a video replay, a mask, or a deepfake. This is the type that matters most for identity verification and it is covered below.
Why authentication keeps arriving late
The pattern across all of these is the same, and it explains why spoofing is durable rather than a solved problem.
Each protocol was designed in a context where participants were assumed to be trustworthy — a small academic network, a closed carrier system, a satellite service with no adversaries. The identifier was made readable because reading it was the requirement. Authentication was retrofitted later, once the assumption failed, and retrofits have to preserve backward compatibility with everything already deployed.
That produces two persistent gaps. Adoption is partial, so an unauthenticated message is not proof of an attack — it might be a legitimate sender who has not implemented the standard. And authentication of the identifier is not authentication of the actor: DMARC confirms a domain, STIR/SHAKEN confirms a right to use a number, TLS confirms a connection. None confirms who is on the other end.
Why it matters for identity verification
Biometric spoofing is where identity verification meets this family directly, and it is worth being precise about how the attacks differ.
A presentation attack shows something to the camera — a printed photo, a phone screen, a mask. Liveness detection is the control, and it works by looking for the evidence of physical presence that an artifact cannot reproduce: depth, texture, micro-movement, the way light behaves on skin rather than on paper or glass.
An injection attack does not use the camera at all. It feeds a synthetic video stream directly into the application, bypassing the sensor, which means image analysis is examining a frame that was never photographed. This is the harder problem and the one that separates serious vendors — a supplier answering an injection question by describing image quality analysis is answering a different question.
The wider point holds across the whole family. Every anti-spoofing control listed above authenticates a channel: a domain, a number, a connection, a location. Identity verification authenticates the actor. That is why it keeps its value when a channel control fails, and why the two are complements rather than alternatives.
Spoofing compared with related deceptions
| Spoofing | Phishing | Man in the middle | |
|---|---|---|---|
| What is falsified | An identifier | A pretext and often an identifier | Position in the conversation |
| Requires interception | No | No | Yes |
| Target | The system or the recipient’s trust | The recipient’s judgment | The session |
| Relationship | Often the delivery method | Often uses spoofing | May use spoofing to establish |
Spoofing and phishing are frequently used interchangeably and are not the same thing. Spoofing is the falsification; phishing is the deception it usually serves. A phishing email typically uses a spoofed sender, and spoofing is also used for attacks that involve no phishing at all.
What anti-spoofing controls cannot do
They cannot authenticate a lookalike. A domain the attacker owns passes SPF, DKIM and DMARC correctly, because the attacker is its legitimate operator.
Partial adoption limits enforcement. Rejecting everything unauthenticated blocks legitimate senders who have not implemented the standards, so most organizations cannot enforce strictly.
A compromised account is not spoofed. Mail sent from a truly compromised mailbox is authentic on every technical measure, which is why business email compromise defeats email authentication entirely.
Liveness does not cover injection. Detecting a physically present face is a different problem from detecting a stream that never came from a camera, and the two need separate defenses.
Frequently asked questions
What is the difference between spoofing and phishing?
Spoofing falsifies an identifier so something appears to come from a trusted source. Phishing is the deception that persuades someone to act. Most phishing uses spoofing to look credible, but spoofing is also used in attacks with no phishing element, such as evading IP reputation controls.
Do SPF, DKIM and DMARC stop email spoofing?
They stop forgery of domains that have implemented them, which is a real improvement. They do not stop an attacker using a lookalike domain they legitimately own, and they do nothing about mail sent from a truly compromised account, which is authentic by every measure.
What is biometric spoofing?
Presenting an artifact to a biometric sensor to impersonate someone — a printed photo, a face displayed on a screen, a video replay, a mask or a deepfake. It is usually called a presentation attack, and liveness detection is the control designed against it.
What is the difference between a presentation attack and an injection attack?
A presentation attack shows something to the camera and can be countered by liveness detection. An injection attack feeds a synthetic stream directly into the application, bypassing the camera entirely, so the system analyzes a frame that was never photographed. They require different defenses.
Related reading
- Liveness detection — the control against presentation attacks
- Deepfake — the synthetic media used in the hardest cases
- Phishing — the deception spoofing most often serves
- Business email compromise — the attack that needs no spoofing at all
