Display-name spoofing is a form of impersonation that abuses the friendly name shown beside an email address. An address is written as Finance Team <attacker@gmail.com>, but many mail clients, especially on mobile, show only the display name. The recipient sees a trusted name and never notices the underlying address is unrelated.
It matters because it is cheap, effective and often the opening move in business email compromise and phishing. The attacker does not need to control your domain at all, which is what makes this attack distinct from outright domain forgery.
This is also why DMARC does not stop it on its own. DMARC validates the domain in the From header against SPF and DKIM; if the message is sent from a domain the attacker legitimately controls, it can pass authentication while still carrying a deceptive display name.
Defending against it combines layers: enforce DMARC so your real domain cannot be forged, train staff to inspect the full address rather than the name, and adopt BIMI so verified senders show a trusted logo that imposters cannot replicate. Watch too for the related trick of lookalike domains in the address itself.
Check it on your domain
- Fake Email Address Checker: check whether an email address looks deliverable.
- Phishing Email Checker: analyse a suspicious email's headers and content.
- Spoofable Status Badge: generate an embeddable badge that shows your domain's live DMARC status.