Familiar name, unfamiliar address
Expanding the sender details reveals an external or unrelated address behind a trusted display name.
Display Name Spoofing Awareness
How to Recognize and Report Display Name Spoofing
Display name spoofing places a trusted person or organization in the visible sender-name field while the underlying email address belongs to someone else.
Use this guide to turn the threat into a clear employee decision, a safe practice scenario, and a reporting step your organization can support.
Plain-English definition • Warning signs • Safe simulation ideas • Reporting practice
01Understand the threat
Display Name Spoofing: a practical definition
Display name spoofing places a trusted person or organization in the visible sender-name field while the underlying email address belongs to someone else.
The attack does not necessarily require control of the trusted person's domain or mailbox. It exploits mail interfaces that emphasize the friendly name and may hide the full address on small screens.
Source: CISA Phishing Guidance
02Recognition clues
Warning signs employees can check in a display name spoofing message
No single clue proves that a message is malicious. Teach employees to combine the request, sender, business context, destination, and available verification route before acting.
First contact with urgency
A supposed leader, coworker, or supplier makes an unusual request without the context normally present in the relationship.
Mobile visibility limits
The mail client shows only the display name until the user opens additional sender details.
03Safe response
Move from suspicion to a supported next step
| Moment | Employee action | Program preparation |
|---|---|---|
| Before acting | Expand the sender details and confirm an unusual request through the known directory, prior contact record, or established business process. | Publish the authentic contact, application, or reporting route somewhere employees can reach without using the message. |
| When uncertain | Pause the request and report it through the approved channel with enough context for review. | Explain what the response team needs and how employees will know that their report was received. |
| After an interaction | Stop, contact the responsible team promptly, and describe the action taken without hiding the mistake. | Provide a well-known response route and avoid communications that discourage early reporting. |
Source: NIST: Recognizing, verifying, and reporting phishing
04Practice safely
Display Name Spoofing simulation and discussion ideas
Choose one learning objective per exercise. Use fictional people, organizations, accounts, payments, documents, and events, and test the reporting route before sending to employees.
Mobile sender check
Test how representative mobile clients expose the underlying address and teach the exact interaction employees can use.
Fictional manager request
Use an approved invented manager identity to practice checking sender details before responding.
Supplier-name collision
Present two fictional senders with the same visible company name and compare address and workflow context.
05Campaign workflow
Build the exercise around a decision employees can repeat
- 1
Define the behavior
Write down the display name spoofing clue being practiced, the expected action, the authorized audience, and the owner of follow-up.
- 2
Confirm the real process
Test the independent verification route, message-reporting option, response handoff, and employee support path from a representative account.
- 3
Pilot the scenario
Check delivery, links, landing content, accessibility, event records, automated inspection, stop conditions, and the explanation employees will receive.
- 4
Review in context
Reconcile intended recipients, successful deliveries, unique employee events, verified reports, response handling, and completed follow-up before drawing conclusions.
Source: NIST SP 800-50 Rev. 1: Building a Cybersecurity and Privacy Learning Program
06Useful measurement
Evaluate recognition, reporting, and the surrounding process
Record actual counts and denominators for delivery, unique recipient events, reports, and follow-up. Separate automated email inspection and repeat events where the available evidence supports doing so.
A display name spoofing exercise samples one scenario under one set of conditions. It does not establish an employee's intent, overall security awareness, or likelihood of responding the same way to a real attack.
Use findings to improve the real workflow: clearer verification instructions, easier reporting, faster response handling, better role-specific training, or a business control that reduces reliance on email alone.
Common questions
Common questions about Phishmake's features, onboarding, and support, answered to help you get started with confidence.
Is display name spoofing the same as domain spoofing?
No. Display name spoofing can use an unrelated address with a trusted visible name. Domain spoofing makes the address or domain itself appear to belong to another organization.
Why is this harder to notice on mobile?
Many mobile mail clients initially show the friendly name and hide the complete address. Training should demonstrate how the organization's actual clients reveal sender details.
Can display name spoofing be used in a phishing simulation?
It can be practiced when the scenario is authorized, proportionate, and tied to a real reporting or verification process. Use fictional or explicitly approved identities. Do not impersonate a real employee in a sensitive, disciplinary, personal, or financial scenario without documented authorization.
How should display name spoofing simulation results be measured?
Review successful delivery, unique employee events, reports, response handling, and completed follow-up. Include scenario difficulty and operating context, and do not treat a click or report as a complete measure of employee risk.
Sources & further reading
Published by Phishmake · Updated
Keep building your program
All resourcesPut it into practice
Turn display name spoofing awareness into a repeatable response.
Use Phishmake to run controlled employee simulations, review campaign activity, assign relevant training, and keep follow-up records in one workflow.