# What is Reply-To header mismatch phishing, and how do you stop it?

URL: https://iblockspam.com/blog/reply-to-header-mismatch-phishing
Last updated: 2026-10-12
Published: 2026-10-12
Topic: Phishing & threats
Author: iBlockSpam Team

> How scammers use a Reply-To that differs from From to hijack your replies, when a mismatch is legitimate, how to check it, and how admins can flag it.

## Short answer

Reply-To mismatch phishing is an email whose From address looks legitimate while the Reply-To header sends your answer to an address the attacker controls. The message can even pass DMARC, because DMARC checks only the From domain. Check where Reply will go before answering, and confirm money or data requests through a known phone number.

A Reply-To mismatch is one of the quietest phishing tricks. The message looks like it comes from a real colleague, customer or supplier, and it may pass every authentication check. But when you click Reply, your answer goes to someone else. This guide explains how the trick works, when a different Reply-To is normal, and what users and admins can do about it.

## What is the Reply-To header?

The Reply-To header is an optional email header that tells mail apps where replies should go. [RFC 5322, section 3.6.2](https://www.rfc-editor.org/rfc/rfc5322.html#section-3.6.2) says that when it's present, it gives the address or addresses "to which the author of the message suggests that replies be sent". When it's absent, replies go to the From address.

The sender writes this header, so it can contain anything. Here is an example of a mismatched message's headers:

```
From: "Dana Price, Accounts" <dana.price@supplier-example.com>
Reply-To: dana.price.accounts@gmail.example
To: ap@yourcompany.example
Subject: Updated remittance details for invoice 4471
```

The reader sees Dana's real address. When they click Reply, their mail app fills in the Gmail-style address instead.

## How does Reply-To mismatch phishing work?

Reply-To mismatch phishing works by letting a believable From address carry the message while the Reply-To quietly reroutes the conversation. The attacker doesn't need to receive mail at the real domain. They only need you to answer.

Three common setups:

1. **Spoofed or lookalike From, attacker Reply-To.** The From is a [lookalike domain](https://iblockspam.com/blog/lookalike-domain-phishing) or a [display name](https://iblockspam.com/blog/display-name-spoofing) trick, and the Reply-To points to a webmail account.
2. **Compromised real account, attacker Reply-To.** The attacker has stolen a supplier's mailbox password. The message genuinely comes from the supplier's server and passes DMARC. Setting Reply-To to an outside address keeps the follow-up conversation out of the real owner's mailbox. This often pairs with [email thread hijacking](https://iblockspam.com/blog/email-thread-hijacking).
3. **Legitimate bulk platform, attacker Reply-To.** The attacker signs up for a mailing service, which sends the message from its own authenticated domain, with an attacker Reply-To.

The goal is usually payment fraud. The FBI's Internet Crime Complaint Center reported exposed losses of more than $55 billion from business email compromise between October 2013 and December 2023 in its [September 2024 PSA](https://www.ic3.gov/PSA/2024/PSA240911). Its advice includes using "secondary channels and/or two-factor authentication to verify requests for changes in account information". For the full payment-fraud pattern, see [vendor invoice fraud and payment redirection](https://iblockspam.com/blog/vendor-invoice-fraud-payment-redirection).

## Why doesn't DMARC stop Reply-To phishing?

DMARC doesn't stop Reply-To phishing because it only authenticates the domain in the From header. [RFC 9989](https://www.rfc-editor.org/rfc/rfc9989.html), the DMARC standard, lists "evaluation of anything other than the RFC5322.From header field" as out of scope in section 2.4. Section 2.2 adds that DMARC doesn't address lookalike domains or display-name abuse.

So a message can show `dmarc=pass` and still route your reply to a stranger. Authentication tells you which system sent the message. It says nothing about where your answer will go. Our guide on [how to read email headers](https://iblockspam.com/blog/how-to-read-email-headers) shows where each field comes from.

## How are From, Reply-To and Return-Path different?

From, Reply-To and Return-Path are three different addresses in one message, and each does a different job. Mail apps show From prominently and hide the other two, which is exactly why attackers like Reply-To.

| Field | Who sets it | What it's used for | Checked by authentication? |
|---|---|---|---|
| From | The sender | The author shown to the reader | Yes: DMARC checks this domain |
| Reply-To | The sender | Where a person's reply goes | No |
| Return-Path | The sending server sets the envelope sender (MAIL FROM); the final receiving server writes it into this header | Where bounces go | Yes: SPF checks this domain |

[RFC 5321, section 4.4](https://www.rfc-editor.org/rfc/rfc5321.html#section-4.4) says the server making final delivery inserts the return-path line, which "preserves the information in the `<reverse-path>` from the MAIL command". Microsoft describes the envelope sender as "the MAIL FROM value that was used in the SMTP transmission, which is typically stored in the Return-Path field" ([Microsoft Learn](https://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/conditions-and-exceptions)). A message can have three different domains in these fields and still be legitimate, which is why a person, not just a filter, has to judge the request.

Here is an example of how a mismatch plays out in a conversation. It's an illustration, not a real message:

```
From: "Mark Chen, CEO" <mark.chen@yourcompany.example>
Reply-To: mark.chen.office@outlook.example
Subject: Quick favor

Are you at your desk? I need you to handle a payment for a new
vendor today. I'm in meetings, so reply here and I'll send details.
```

If the employee replies, the attacker receives the answer and sends "payment details" from the outside address. The real CEO never sees the thread.

## When is a different Reply-To address legitimate?

A different Reply-To is legitimate when an organization deliberately routes replies somewhere other than the sending address. That's common, which is why filters can't simply block every mismatch.

| Situation | Typical From | Typical Reply-To | Risk |
|---|---|---|---|
| Newsletter or marketing email | `news@brand.example` | `support@brand.example` | Low: same organization |
| Website contact form | `forms@yourcompany.example` | The visitor's own address | Low: expected; see [website form emails](https://iblockspam.com/blog/website-form-emails-going-to-spam) |
| Helpdesk ticket update | `support@vendor.example` | `ticket+12345@vendor.example` | Low: same domain, tracking address |
| Mailing list | The original poster or the list | The list address | Low: list setting; see [DMARC and mailing lists](https://iblockspam.com/blog/dmarc-and-mailing-lists) |
| Invoice or payment request | A supplier or your CEO | A free webmail address | High |
| Payroll or bank detail change | An employee | An unrelated domain | High |
| Request for W-2s, contracts or passwords | An executive or partner | A different organization's domain | High |

The pattern to watch: the Reply-To is on a **different organization's domain**, especially free webmail, **and** the message asks for money, data or credentials.

## How do I check the Reply-To before answering?

You check the Reply-To by looking at where your reply is addressed before you send it. Use this checklist on any message that asks you to act:

1. **Click Reply, then stop.** Read the address that appears in the To field. RFC 5322 notes that the Reply-To addresses "MAY appear in the 'To:' field of the reply", and mail apps do this automatically.
2. **Compare it with the sender's full address**, not the display name. The FBI advises you to "verify the email address used to send emails, especially when using a mobile or handheld device."
3. **Check the domain.** Is it the same organization? A free webmail address replacing a company address is a red flag.
4. **Open the full headers** if anything looks off. Paste them into the [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer), which runs in your browser and shows From, Reply-To, Return-Path and authentication results side by side.
5. **Verify out of band.** For payments, bank details or sensitive files, call the person on a number you already have, not one in the email.
6. **Report it.** If it's suspicious, use your report button or follow [how to report a phishing email](https://iblockspam.com/blog/report-phishing-email).

## How can admins flag Reply-To mismatches?

Admins can flag Reply-To mismatches with mail flow rules, though built-in tools match patterns rather than comparing headers. At the time of writing (October 2026), neither Exchange Online mail flow rules nor Google Workspace content compliance has a condition that directly compares Reply-To with From.

### Microsoft 365: a mail flow rule on the Reply-To header

Exchange Online has a condition called **A message header matches** (`HeaderMatchesMessageHeader` and `HeaderMatchesPatterns` in PowerShell). [Microsoft Learn](https://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/conditions-and-exceptions) says it finds messages that "contain the specified header field" whose value matches the regular expressions you give, and that rule regular expressions "are NOT case sensitive". A practical rule:

1. In the Exchange admin center, go to **Mail flow** > **Rules**, then **Add a rule** > **Create a new rule**.
2. Add the condition **The sender** > **is external/internal** and choose **Outside the organization**.
3. Add **A message header** > **matches these text patterns**, header `Reply-To`, with a pattern for free webmail domains your partners don't use, for example `@(gmail|outlook|hotmail|yahoo|aol)\.com`.
4. Choose an action such as prepending a warning disclaimer, rather than blocking.
5. Add exceptions for known senders that legitimately use these addresses.
6. Set **Rule mode** to **Test without Policy Tips** first. Microsoft says no actions related to message delivery are taken in that mode. Leave **Severity** at any value except **Not audit**, enable the rule (new rules created in the admin center start disabled), review matches in the **Exchange Transport Rule report** under **Reports** > **Mail flow**, then switch to **Enforce**.

Our [mail flow rules for security](https://iblockspam.com/blog/microsoft-365-mail-flow-rules-for-security) guide covers testing and rule order.

### Google Workspace: a content compliance rule

Google Workspace content compliance rules can match **Full headers** with a regular expression. Google's [help page](https://knowledge.workspace.google.com/admin/gmail/advanced/set-up-rules-for-advanced-email-content-filtering) says "each header field is compared one at a time against the regex", so a pattern that targets a webmail domain after `Reply-To` may work. Google doesn't say whether the header name is part of the text the regex sees, so test with sample messages before you rely on it. Gmail's [external recipient warnings](https://knowledge.workspace.google.com/admin/gmail/advanced/control-gmail-external-recipient-warnings), on by default, also warn users when they reply to an external address that isn't in the directory or their contacts. See [Google Workspace content compliance rules](https://iblockspam.com/blog/google-workspace-content-compliance-rules) for setup steps.

### Train for it

Rules catch the obvious cases. Teach finance, HR and assistants the "click Reply, then stop" habit, and add a Reply-To example to your [awareness training](https://iblockspam.com/blog/email-security-awareness-training-small-business).

## What should I do if I already replied?

If you already replied to a mismatched Reply-To, assume the attacker now has whatever you sent and act quickly:

- **If you sent money**, call your bank at once and ask for a recall, then report to the [FBI IC3](https://www.ic3.gov/). Speed matters.
- **If you sent credentials**, change the password, sign out all sessions and check for new [inbox rules or forwarding](https://iblockspam.com/blog/malicious-inbox-rules-auto-forwarding).
- **If you sent files**, list what was in them and tell whoever handles data incidents.
- **Warn the real sender** using a known contact method, in case their account is compromised.

Our [email security incident response plan](https://iblockspam.com/blog/email-security-incident-response-plan) has the full first-hour checklist.

## Next steps

- Check one recent payment request in the [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer) and compare From, Reply-To and Return-Path.
- Add a Reply-To check to your payment-change procedure: any new bank details need a phone call to a known number.
- Build a test-mode mail flow or content compliance rule for free-webmail Reply-To addresses on external mail.
- Spoofed senders are the easier half of this problem to block. iBlockSpam filters inbound mail at the MX level for phishing and spoofing; see [how it works](https://iblockspam.com/how-it-works).

## Frequently asked questions

### Can an email pass SPF, DKIM and DMARC and still have a malicious Reply-To?

Yes. DMARC checks only the domain in the From header. RFC 9989 lists evaluation of any other header field as out of scope, so Reply-To isn't authenticated at all. An attacker who sends from a compromised real account, or from their own correctly authenticated lookalike domain, can set any Reply-To address they like.

### How do I see the Reply-To address on my phone?

Tap Reply and look at the To field before you type anything; it shows where your answer will go. On most mobile apps you can also tap the sender's name to expand the full header details. If the address in the To field differs from the sender you expected, stop and verify by phone.

### Is a different Reply-To address always a sign of phishing?

No. Newsletters, website contact forms, support desks and mailing lists often set Reply-To on purpose. A mismatch is a warning sign, not proof. It matters most when the Reply-To is on a free webmail or unrelated domain and the message asks for payment, bank details, gift cards, credentials or sensitive files.

### What is the difference between Reply-To and Return-Path?

Reply-To is where a person's reply goes, and it's set by the sender in the message headers. Return-Path records the envelope sender, where automated bounce messages go, and it's the domain SPF checks. Neither is shown prominently by most mail apps, and attackers can set Reply-To freely.

### Can a mail flow rule flag mismatched Reply-To addresses in Microsoft 365?

Partly. Exchange Online rules can match text patterns in a named header such as Reply-To, so you can flag external mail whose Reply-To uses a free webmail domain. There's no built-in condition that compares Reply-To with From directly, so a perfect mismatch rule isn't possible with mail flow rules alone.

## Sources

- [RFC 5322: Internet Message Format, section 3.6.2 (Originator Fields)](https://www.rfc-editor.org/rfc/rfc5322.html#section-3.6.2)
- [RFC 5321: Simple Mail Transfer Protocol, section 4.4 (Trace Information)](https://www.rfc-editor.org/rfc/rfc5321.html#section-4.4)
- [RFC 9989: DMARC, sections 2.2 and 2.4](https://www.rfc-editor.org/rfc/rfc9989.html)
- [FBI IC3 PSA I-091124-PSA: Business Email Compromise: The $55 Billion Scam](https://www.ic3.gov/PSA/2024/PSA240911)
- [Microsoft Learn: Mail flow rule conditions and exceptions in Exchange Online](https://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/conditions-and-exceptions)
- [Google Workspace Admin Help: Set up rules for advanced email content filtering](https://knowledge.workspace.google.com/admin/gmail/advanced/set-up-rules-for-advanced-email-content-filtering)
- [Google Workspace Admin Help: Control Gmail external recipient warnings](https://knowledge.workspace.google.com/admin/gmail/advanced/control-gmail-external-recipient-warnings)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.

---

Source: iBlockSpam, https://iblockspam.com/blog/reply-to-header-mismatch-phishing (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt