Spoofing

Spoofing is the act of disguising a communication or a piece of data so that it appears to come from a trusted source when it does not. In payments and banking the word mainly refers to faked email addresses, phone numbers, text message sender names, websites and device or network identifiers, which criminals use to impersonate banks, suppliers, officials or customers. In financial markets, spoofing has a separate legal meaning: placing orders with the intent to cancel them before execution in order to mislead other traders.

Spoofing is a technique rather than a crime type of its own. It supports phishing, social engineering, business email compromise and authorised push payment fraud, all of which depend on the victim believing the message is real. In the security sense, the US National Institute of Standards and Technology describes it as an attempt to gain access to a system by posing as an authorised user, and lists impersonating and masquerading among its forms.

Spoofing is like a letter with someone else's return address written on the envelope. The post office delivers it anyway, because nobody checks that the sender's address is true. When the envelope says it came from your bank, you are more likely to trust what is inside.

Phone calls work the same way. The number shown on your screen is information sent by the caller, and in older phone networks the caller could type in any number they liked, including your bank's real helpline. That is why a call can look exactly right and still come from a criminal.

• Email spoofing. Forging the "From" address, or using a lookalike domain such as one with a swapped letter, so a message appears to come from a bank, a supplier or a company's own chief executive.
• Caller ID spoofing. Displaying a trusted number, often the victim's bank or the police, during a scam call. It is a core tool in "safe account" scams.
• SMS sender ID spoofing. Sending text messages that appear in the same thread as a bank's genuine messages, because the sender name is copied.
• Website and domain spoofing. Copying a bank's or shop's website on a similar address to collect logins and card details.
• Device and location spoofing. Faking device identifiers, browser settings or GPS location so that a criminal's session looks like the real customer's, used to defeat digital fingerprint checks during account takeover.
• Biometric spoofing. Presenting a photo, mask, recording or synthetic video to fool face or voice checks, which systems try to block with liveness testing.

Each channel has its own defences. For email, the SPF, DKIM and DMARC standards let a domain owner publish which servers may send its mail and sign messages cryptographically, so receiving servers can reject forgeries of the exact domain. They do not stop lookalike domains, which are fought with monitoring and takedowns.

For phone calls, the US Truth in Caller ID Act of 2009 prohibits spoofing caller ID with intent to defraud or cause harm, and the Federal Communications Commission required voice providers to deploy the STIR/SHAKEN call authentication framework in the internet-protocol parts of their networks by 30 June 2021, under the TRACED Act. In the UK, telecom operators block calls from abroad that falsely show UK numbers, and the industry runs an SMS sender ID registry so that only registered organisations can use protected names such as a bank's.

Banks add their own layers: verification of payee checks that the account name matches the intended recipient, strong customer authentication displays the amount and payee being approved, and behavioral analytics can spot a customer who is acting under instruction from a caller. On the regulatory side, the EU's political agreement of November 2025 on a new Payment Services Regulation includes refund rights for customers deceived by criminals impersonating their own bank, subject to the final adopted text.

In trading, spoofing means bidding or offering with the intent to cancel the order before it is executed. A trader places large orders on one side of the market to create a false impression of supply or demand, then trades on the other side at the improved price and cancels the large orders. The Dodd-Frank Act of 2010 made the practice explicitly unlawful in US futures and commodity markets under the Commodity Exchange Act, enforced by the Commodity Futures Trading Commission. The CFTC and the Department of Justice have brought a number of cases, including a 2020 resolution in which JPMorgan agreed to pay about $920 million over spoofing in precious metals and Treasury futures. In the EU, spoofing is treated as market manipulation under the Market Abuse Regulation. Market surveillance teams use anomaly detection on order-to-trade ratios and cancellation patterns, and the practice is distinct from insider trading because it relies on false signals rather than secret information. Spoofing is a particular risk in algorithmic trading, where orders can be placed and cancelled in milliseconds.

Because a spoofed message can look perfect, the safest response is to verify through a separate channel: hang up and call the number printed on the card, open the bank's app rather than a link, and confirm any change of supplier bank details by phoning a known contact. Firms treat repeated spoofing of their brand as part of reputational risk and cybersecurity risk, and a spoofed request is a classic route into payment diversion fraud.

• NIST Computer Security Resource Center: Spoofing
• Commodity Futures Trading Commission: Dodd-Frank Act