# What is display name spoofing, and how do you stop it? URL: https://iblockspam.com/blog/display-name-spoofing Last updated: 2026-10-10 Published: 2026-10-10 Topic: Phishing & threats Author: iBlockSpam Team > Why email showing your CEO's name from a free account passes every check, how it differs from domain spoofing, and the Microsoft 365 and Gmail settings to use. ## Short answer Display name spoofing is when an attacker sets the visible sender name to someone you trust, such as your CEO, while sending from an address they control, often a free mail account. SPF, DKIM and DMARC pass because the address is genuine. Defend with impersonation protection, external-sender tags, warnings for first-time senders and a habit of checking the full address. The cheapest impersonation attack needs no hacking and no lookalike domain. The attacker opens a free mailbox, sets the name to "Jane Smith, CEO", and emails your finance team. On a phone, the name is often all anyone sees. This guide shows how display name spoofing works, how it differs from other spoofing, and the settings in Microsoft 365 and Google Workspace that catch it. ## What is display name spoofing? Every From header has two parts: an optional display name and the actual address. [RFC 5322, section 3.4](https://www.rfc-editor.org/rfc/rfc5322.html#section-3.4) defines a mailbox as an optional display name followed by the address in angle brackets. The display name is free text chosen by the sender. Nothing checks it. ``` From: "Jane Smith" From: "Jane Smith (CEO)" From: "jane@yourcompany.com" ``` The third example is a common trick: the display name is itself an email address, so a client that shows only the name appears to show your domain. ## How is it different from domain spoofing and lookalike domains? Our guide to [what email spoofing is](https://iblockspam.com/blog/what-is-email-spoofing) covers all three types in detail. In short: | Type | Example From | Passes SPF, DKIM, DMARC? | Main defense | |---|---|---|---| | Display name spoofing | `"Jane Smith" ` | Yes, for gmail.com | User impersonation checks, external tags, process | | Exact-domain spoofing | `jane@yourcompany.com` from an unauthorized server | No, fails with DMARC at enforcement | DMARC `p=quarantine` or `p=reject` | | [Lookalike domain](https://iblockspam.com/blog/lookalike-domain-phishing) | `jane@yourcompany-invoices.com` | Yes, for the attacker's domain | Domain impersonation checks, registrations | DMARC was never designed to catch the first row. [RFC 9989](https://www.rfc-editor.org/rfc/rfc9989.html), section 2.4, lists "attacks in the display name portions of the RFC5322.From header field" as out of scope. Even a perfect DMARC record on your domain does nothing here, because your domain isn't in the message. ## Why does display name spoofing work? - **Mobile clients show names.** Many phone mail apps display only the name until you tap it. The FBI's advice is to "verify the email address used to send emails, especially when using a mobile or handheld device" ([IC3](https://www.ic3.gov/PSA/2024/PSA240911)). - **It passes authentication honestly.** A message from a real Gmail or Outlook.com account passes SPF, DKIM and DMARC for that provider. Filters that weigh authentication see a well-behaved sender. - **It's free and disposable.** When one account is reported, the attacker opens another. - **Executives do use personal email.** "Sorry, writing from my personal account" is plausible, which is why the opening line often says exactly that. Common goals are [gift card scams](https://iblockspam.com/blog/gift-card-scam-emails), urgent wire transfers, payroll changes and requests for employee tax or payroll records. These are all forms of [business email compromise](https://iblockspam.com/blog/business-email-compromise-prevention). ## What are the warning signs? - The name is right but the address is a free mail domain or an unrelated company. - The display name contains an email address or a job title in brackets. - "I'm in a meeting, just reply here" or "don't call, I can't talk." - A request to move money, buy gift cards, change payroll details or send employee records. - A Reply-To that differs from the From address. - An External tag or first-contact warning on a message that claims to be from a colleague. That last one is the strongest signal. Your CEO's real mail comes from inside your organization. If a message claiming to be from her carries an External tag, stop. ## What does a display name spoofing email look like? Here's a typical example, with the details that give it away: ``` From: "Jane Smith" To: accounts@yourcompany.com Subject: Quick favor Hi, are you at your desk? I'm stuck in a board meeting and can't talk. I need a payment sent to a new supplier before 3pm today. Reply here and I'll send the details. Please keep this between us until it's announced. Jane Sent from my iPhone ``` 1. **The address.** Your CEO's name, but a Gmail address. On a phone, the recipient may only see "Jane Smith". 2. **"Are you at your desk?"** An opener designed to get a reply, which confirms the mailbox is read and starts a conversation the attacker controls. 3. **"Can't talk."** It heads off the phone call that would expose the fraud. 4. **Deadline and secrecy.** Pressure to act before anyone else is consulted. 5. **"Sent from my iPhone".** Added to explain the personal address and the short, slightly off tone. Nothing in this message is technically forged. Gmail's servers sent it and signed it. Only the name is a lie, which is why the checks below focus on names and on who your staff normally hear from. ## How does Microsoft 365 catch display name spoofing? Microsoft 365 has several layers. Some are in every plan; the strongest needs Defender for Office 365 ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/anti-phishing-policies-about)). ### User impersonation protection (Defender for Office 365) Microsoft defines user impersonation as "the combination of the user's display name and email address", giving the example of a real user's name with a different address. To use it: 1. In the Defender portal, go to **Email & collaboration** > **Policies & rules** > **Threat policies** > **Anti-phishing**. 2. Edit your policy, turn on **Enable users to protect** and add your executives, finance staff and key external contacts. Each policy holds up to 350 users. 3. Set the action, for example **Quarantine the message**. The default is **Don't apply any action**, and by default no users are protected at all. 4. Turn on **Show user impersonation safety tip**. Recipients then see: "<Sender> appears similar to someone who previously sent you email, but may not be that person." Know one limit: when both **Enable mailbox intelligence** and **Enable intelligence for impersonation protection** are on, Microsoft says user impersonation protection "doesn't work if the sender and recipient previously communicated via email." A spoofer who has already traded messages with the target can slip past it. ### First contact safety tip (all plans) The **Show first contact safety tip** setting is available in every Microsoft 365 anti-phishing policy. It shows "You don't often get email from <email address>" when a sender is new or rare for that recipient. Microsoft recommends turning it on. A spoofer writing from a brand-new free account is, by definition, a sender your staff don't often hear from. ### External tag and banners (all plans) The native External tag marks every message from outside your organization. Our guide to the [Outlook external email warning tag](https://iblockspam.com/blog/outlook-external-email-warning-tag) walks through `Set-ExternalInOutlook` and banner alternatives. ### A mail flow rule for executive names You can also flag external mail that uses an executive's name. The conditions **The sender is located** (*FromScope*) and **A message header matches** (*HeaderMatchesMessageHeader* and *HeaderMatchesPatterns*) are both documented by [Microsoft](https://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/conditions-and-exceptions): ```powershell New-TransportRule -Name "Flag external mail using executive names" ` -FromScope NotInOrganization ` -HeaderMatchesMessageHeader From ` -HeaderMatchesPatterns "Jane\s+Smith","John\s+Doe" ` -PrependSubject "[Check sender] " ` -Mode AuditAndNotify ``` Microsoft notes header matching happens after the header is decoded, so encoded names still match. Patterns aren't case-sensitive. Test in audit mode, then switch to `-Mode Enforce`. Add exceptions for the executives' known personal addresses if they genuinely use them. Our guide to [Microsoft 365 mail flow rules for security](https://iblockspam.com/blog/microsoft-365-mail-flow-rules-for-security) covers testing rules safely. ## How does Gmail handle display name spoofing? Google Workspace has a matching control ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/gmail/advanced/advanced-phishing-and-malware-protection)): 1. In the Google Admin console, go to **Apps** > **Google Workspace** > **Gmail** > **Safety**. 2. Under **Spoofing and authentication**, turn on **Protect against spoofing of employee names**. Google describes it as protection against messages "where the sender's name is a name in your Google Workspace directory" but the mail doesn't come from your domain. 3. Choose an action: **Keep email in inbox and show warning (Default)**, **Move email to spam** or **Quarantine**. You need the Gmail Settings administrator privilege. Recipients then see a warning banner; our guide to [Gmail warning banners](https://iblockspam.com/blog/gmail-warning-banners-explained) explains what each one means. ## How does an email gateway help? An MX-level filter sees every message before your mailbox platform does, so it adds a second set of phishing and spoofing checks in front of Microsoft 365 or Google Workspace. Its approved and blocked sender lists can also require sender verification, so a message that merely claims a trusted identity isn't waved through. Be realistic about the limit. No filter can know for certain that a new Gmail account isn't your CEO's real personal address. Technical controls raise the warning; your payment process has to do the rest. ## Practical rules that stop it 1. **Tap the name.** Check the full address on every request involving money, credentials or employee data. 2. **Executives never ask for gift cards or urgent transfers by email.** Say so in writing, from the top. 3. **Verify by phone** on a number you already hold, never one from the email. 4. **Treat an External tag on a "colleague" as a red flag**, not decoration. 5. **Report, don't reply.** Use your [phishing report process](https://iblockspam.com/blog/report-phishing-email) so IT can block the address for everyone. ## Next steps 1. Turn on the first contact safety tip and the External tag in Microsoft 365, or employee-name spoofing protection in Google Workspace. 2. If you have Defender for Office 365, add your executives and finance team to user impersonation protection and choose an action other than the default. 3. Paste a suspicious message's headers into the [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer) to see the real sender and Reply-To. 4. Add an extra layer of inbound filtering. iBlockSpam checks for phishing and spoofing at the MX before mail reaches your users; see [how it works](https://iblockspam.com/how-it-works). iBlockSpam's [allow and block lists](https://iblockspam.com/features/allow-block-lists) can require sender verification, so an approved name can't simply be copied by another address. Browse our other [phishing and threat guides](https://iblockspam.com/blog/topic/threats). ## Frequently asked questions ### Why doesn't DMARC stop display name spoofing? DMARC checks that the domain in the From address is authenticated. In display name spoofing, that domain belongs to the attacker or to a free mail provider, and it authenticates correctly. The forged part is only the name in front of the address, which RFC 9989 explicitly puts out of scope for DMARC. Your own DMARC policy never gets involved. ### How do I see the real email address on my phone? In most mobile mail apps, tap the sender's name at the top of the message to expand it and show the full address. Do this before acting on any request for money, gift cards, passwords or bank changes. The FBI specifically advises verifying the sender address when using a mobile or handheld device. ### Does Microsoft 365 block display name spoofing by default? Not fully. User impersonation protection, which compares sender names and addresses against people you choose to protect, is only in Defender for Office 365, and no users are protected until you add them. The first contact safety tip and the External tag work in all Microsoft 365 plans, but you have to turn them on. ### Is display name spoofing the same as a lookalike domain? No. Display name spoofing fakes only the name and uses any address, often a free account. A lookalike domain is a registered domain made to resemble a real one, such as a swapped letter. Both pass authentication, but lookalikes are caught by domain impersonation checks, while display name tricks are caught by user impersonation and external-sender warnings. ### Should we add the CEO's name to a block rule? A rule that flags external messages whose From header contains your executives' names works well, but warn or quarantine rather than reject at first. Executives often email from personal accounts, and suppliers may share a name. Run the rule in audit or warning mode for a few weeks to see what it catches before tightening the action. ## Sources - [RFC 5322: Internet Message Format, sections 3.4 and 3.6.2](https://www.rfc-editor.org/rfc/rfc5322.html#section-3.4) - [RFC 9989: DMARC, section 2.4 (Out of Scope)](https://www.rfc-editor.org/rfc/rfc9989.html) - [Microsoft Learn: Anti-phishing policies in Microsoft 365](https://learn.microsoft.com/en-us/defender-office-365/anti-phishing-policies-about) - [Microsoft Learn: Mail flow rule conditions and exceptions in Exchange Online](https://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/conditions-and-exceptions) - [Google Workspace Admin Help: Advanced phishing and malware protection](https://knowledge.workspace.google.com/admin/gmail/advanced/advanced-phishing-and-malware-protection) - [FBI IC3: Business Email Compromise: The $55 Billion Scam (September 2024)](https://www.ic3.gov/PSA/2024/PSA240911) ## Free tools for this guide - [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser. - [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject. - [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan. --- Source: iBlockSpam, https://iblockspam.com/blog/display-name-spoofing (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt