Spoofing explained: types, warning signs and how to protect yourself

Contents:

• What is spoofing?

• What types of spoofing are there?

• Why does spoofing work so well?

• How can you recognise spoofing?

• What should you do if you receive a suspicious call or message?

• What should you do if you’ve already responded?

• How to protect yourself against spoofing

• Conclusion: With spoofing, it’s not just the sender that matters

What is spoofing?

Imagine the doorbell rings. On the intercom screen, you see a parcel delivery driver in uniform holding a parcel with your name on it. Most people would probably let him in – even though they aren’t sure whether he really is who he claims to be. Spoofing works on exactly this principle, but in the digital world.

The term is derived from the English verb ‘to spoof’ and essentially means to feign or deceive. Attackers conceal or falsify their identity – for example, using a manipulated email address, a fake telephone number, a spoofed IP address or a cloned website. The communication therefore appears authentic. It is precisely this trust that fraudsters exploit to trick you, for example, into clicking on a link, entering data or authorising a payment.

What types of spoofing are there?

Spoofing can take many different forms. However, the principle is always the same: fraudsters pretend to be someone or something trustworthy so that a call, a message or a website appears genuine.

• Telephone spoofing: This involves manipulating the displayed telephone number. For example, the number of a bank, government department or well-known company may appear on your screen – even though the call is actually coming from fraudsters. They may claim, for instance, that they need to stop a suspicious payment and ask you for a security code or a TAN.

• Email spoofing: The sender’s address is altered so that an email appears to come from a person or organisation you know. You are often then asked to click on a link, open an attachment or disclose confidential information.

• SMS spoofing: The sender’s details can also be faked in text messages. As a result, a fraudulent message may appear to come from your bank, a parcel delivery service or another trusted provider.

• Website spoofing: Fraudsters recreate well-known websites as closely as possible – complete with logos, colours and a familiar layout. Often, only the web address differs slightly from the original. For example, a purported security email might lead to a fake login page, where any login details entered are sent directly to the fraudsters.

• IP and DNS spoofing: These variants tend to operate in the background. They involve manipulating technical information or redirecting users to fake websites without their knowledge. Such attacks are usually more difficult for individuals to detect. You should therefore take browser warnings seriously and keep your browser, operating system and router software up to date.

In everyday life, individuals encounter telephone, email, text message and website spoofing particularly frequently. These are often used to build trust and make further attempts at fraud appear more credible.

Why does spoofing work so well?

Spoofing relies primarily on trust. A familiar phone number, the name of your own bank or a professionally designed website can quickly give the impression that everything is as it should be.

The deception becomes even more convincing when fraudsters already know your personal details – such as your name, your bank or your employer. The more familiar the contact seems, the less likely you are to question it straight away.

This is precisely where the strength of spoofing lies: the deception is often only recognised after someone has already acted.

How can you spot spoofing?

Spoofing is often difficult to spot at first glance, precisely because it exploits your trust in a familiar sender. It is therefore not just who appears to be writing or calling that matters, but above all what is being asked of you.

Pay particular attention to these warning signs:

• Unexpected contact: A bank, government department or company suddenly gets in touch with an urgent request.
• Time pressure or threats: Phrases such as ‘Your account will be blocked’ or ‘Confirm immediately’ are intended to pressure you into acting quickly.
• Requests for sensitive data: You are asked to disclose passwords, PINs, TANs, security codes or card details.
• Unusual payment requests: You are asked to transfer money, authorise a payment or confirm a new payee.
• Suspicious links or attachments: You are asked to log in via a link or open a file.
• Noticeable discrepancies: Small differences in an email address, web address, spelling or layout may indicate a fake.

Important: Even a familiar telephone number, a familiar sender’s name or a correct logo do not prove that the message is genuine. It is precisely these details that can be manipulated in spoofing attacks.

What should you do if you receive a suspicious call or message?

If a call, text message or email seems unusual, you should not rely on the sender’s details as displayed. Instead, verify the contact details independently.

• End the call: Do not let yourself be pressured. If you receive a suspicious call, you can simply hang up.
• Do not disclose any sensitive information: Do not give out any passwords, PINs, TANs, security codes or card details. Reputable banks will not ask you to disclose your PIN, password, TAN or security codes over the phone, by text message or by email.
• Do not open links or attachments: Go to the provider’s website yourself or use the official app.
• Verify the sender independently: Contact the bank, public authority or company using the contact details on their official website – not the details provided in the suspicious message.
• Do not confirm any payments or authorisations: Only confirm transactions that you have initiated yourself.
• Report suspicious contact: You can report attempted fraud to the National Cyber Security Centre (NCSC).

Important: If you suspect something is amiss, do not simply call back the number displayed. Instead, use a telephone number that you have found yourself via an official source.

What should you do if you have already responded?

If you have responded to a suspicious message, shared your details or confirmed a payment, there is one thing above all else: act quickly and decisively. The steps you need to take depend on what has happened.

• If you’ve entered your login details: Change the affected password immediately via the official website or app. If you use the same password for other services, change it there as well.
• If you’ve shared bank or card details: Contact your bank or card provider straight away and check your transactions for any unauthorised charges. If you suspect card fraud, you should block the affected card immediately.
• PIN, TAN or security code disclosed: Inform your bank or card provider immediately. Such codes can enable fraudsters to authorise payments or log in to accounts.
• Payment authorised: Contact your bank immediately. The quicker you react, the better the chances of limiting further damage.
• Software or remote access installed: Disconnect the device from the internet and have it checked. Then change any important passwords from a trusted device.
• Document the attempted fraud: Keep a record of emails, text messages, screenshots, telephone numbers and any other relevant information. If you suffer financial loss, these may be helpful when making a report or filing a police report.

Greater control with the Swiss Bankers app

With the Swiss Bankers app, you can block your card immediately if necessary, use geoblocking, activate push notifications, manage your card settings and check transactions. This allows you to spot suspicious activity more quickly and limit any potential damage.

How to protect yourself against spoofing

Spoofing cannot always be completely prevented. However, you can significantly reduce the risk by taking a few simple measures.

• Use passkeys or strong two-factor authentication: Where available, passkeys offer particularly good protection against phishing. Authenticator apps are generally less vulnerable to SIM swapping than security codes sent by text message..
• Enable notifications: For example, enable push notifications for logins or transactions in your banking or card app. This allows you to spot unusual activity at an early stage.
• Keep devices and apps up to date: Regular updates patch known security vulnerabilities.
• Save official access points: For important services, use the official app or saved bookmarks rather than opening links from messages.
• Limit the personal information you share: For example, do not publicly share on social media which bank you use or where you work. The less fraudsters know about you, the harder it is for them to create credible scams.

Conclusion: When it comes to spoofing, it’s not just the sender that matters

Spoofing makes fraud attempts particularly convincing because familiar names, telephone numbers, email addresses or websites inspire trust. Yet it is precisely this information that can be manipulated.

You should therefore be on your guard if you are contacted unexpectedly, put under time pressure or asked to disclose sensitive data. Do not rely solely on the displayed sender details. If in doubt, verify the request yourself using the official app, website or phone number.