What it means
Spoofing means pretending to be something you are not. A spoofed email appears to come from your chief executive or a supplier, a spoofed website imitates a bank, and a spoofed phone call shows a number the caller does not own.
The aim is usually to trick someone into paying money or sharing confidential information. Businesses are frequent targets of payment fraud that uses these methods.
A common version is the fake invoice or changed bank details request, sent in the name of a real supplier. Because the message looks familiar, a busy accounts team may pay before anyone checks.
In markets, the word has a second meaning. Spoofing is the illegal practice of placing large orders that the trader never intends to complete, to give a false impression of demand or supply and move the price.
The trader then trades the other way and cancels the large orders before they are filled. Finance teams guard against both forms with controls rather than hope.
Call-back checks to a known number, dual approval of payments, email authentication tools and staff training all reduce the risk. In trading, firms use surveillance software that flags patterns of orders placed and cancelled in quick succession.
Because spoofy is an informal word, it has no legal definition, and it should not be used in formal reports or contracts. When describing an incident, use the precise term, such as email spoofing, website spoofing or market spoofing.
Clear language makes it easier to assess the loss and report it to the right authority. The practical rule is to verify anything unexpected through a second channel.
If a message asks for money, urgency or secrecy, treat it as suspect until you have confirmed it independently. A moment of doubt costs little compared with a wrongly paid invoice.
In practice
Real-world examples.
Example
An accounts clerk receives an email from what looks like a regular supplier, asking to update its bank details. The clerk phones the supplier on the number held in the system and learns that the request is fake. The payment is stopped before any money is lost.
Example
A trader places a large sell order for a stock to make other traders think the price will fall. She then buys at the lower price and cancels the sell order. Regulators later identify the pattern and open an investigation.
Example
A customer receives a text that appears to come from his bank and asks him to confirm a login. The link leads to a copy of the bank's website. He reports it to the real bank, which blocks the site.
Formula
Calculation
Expected annual loss = number of attempts x success rate x average loss per success
Suppose a company receives 2,000 spoofed payment requests in a year and 0.5% get through its checks. That is 2,000 x 0.005 = 10 successful frauds. If the average loss is $8,000, the expected annual loss is 10 x 8,000 = $80,000. A call-back control that cuts the success rate to 0.1% would reduce successes to 2,000 x 0.001 = 2 and the expected loss to 2 x 8,000 = $16,000, a saving of 80,000 - 16,000 = $64,000.Case study
Seen in the real world.
Fairmont Industrial Supply is an illustrative, fictional distributor that paid a $45,000 invoice after receiving a spoofed email from a regular supplier with new bank details. The fraud was discovered only when the real supplier chased the payment two weeks later.
The finance director investigated and found the sender's address differed from the real one by a single letter. She introduced a rule that any change of bank details must be confirmed by phone, using a number already on file, and approved by a second person.
In the following year, three more attempts were stopped at the call-back stage. The illustrative lesson is that a simple second check beats relying on staff to spot a clever forgery.
Watch out
Common mistakes.
- Trusting an email because the display name matches a known person, without checking the actual address.
- Using contact details in the suspicious message to verify it, instead of those already held on file.
- Assuming that only large companies are targeted, when small firms are often seen as easy prey.
Questions
People also ask.
Is spoofy an official term?
No, it is an informal word, so formal reports should name the specific type of spoofing involved.
What should I do if I think a payment request is spoofed?
Do not pay or reply, check it through a known number, and report it to your finance and security teams straight away.
Is market spoofing illegal?
In many major markets it is, because it deceives other traders about real demand or supply.
From the founder's library
Take it further with the book.
Build your financial confidence beyond this definition. Shihan's full-length guide, Accounting Fundamentals, takes the same plain-English approach and turns it into a complete, practical playbook for non-finance managers, business owners and students - with chapter-end quiz answers and presentation slides included.
25% off with code MMHQ25, applied at checkout. Priced in USD - checkout may show the equivalent in your local currency.
View the book and save 25%Related