Email spoofing: what it is and how it works in India

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 4 Nov 2026 · Cyber crime

Email spoofing is the practice of sending a message that appears to come from a trusted address, brand, colleague or institution while actually originating from somewhere else. The visible sender name and even the visible address can be made to look genuine, which is why a spoofed email is so effective: the recipient reads the familiar name, trusts it, and acts before checking anything beneath the surface. In India this conduct engages the Information Technology Act, 2000, sections 66C and 66D, and the Bharatiya Nyaya Sanhita, 2023, sections 318 and 319, with section 336 where a forged document or invoice is attached.

Spoofing is a means, not an end. It is used to do three things: to obtain credentials, to obtain payment, and to obtain action from someone inside an organisation, such as a finance officer asked to approve a transfer. Because the fraud depends on impersonation, the evidence that defeats it is also about identity: the full message with its headers, the reply-to address, and the records that show where the message actually came from. Preserving the message intact, before it is deleted or auto-archived, is the first step after any loss.

What email spoofing is, in plain terms

There are several forms, and they are often confused with one another. Each leaves different traces.

Display-name spoofing

The sender name shown in the inbox is set to something trusted, such as the name of a bank, a vendor or a senior colleague, while the underlying address is entirely different. The recipient sees only the friendly name at first glance. This is the most common form because it requires no technical access to the impersonated party.

Lookalike domain spoofing

The address uses a domain that closely resembles the real one, changed by a letter, a hyphen or a different extension. The message looks official until the domain is read closely. Replies go to the impersonator, and any bank details in the signature belong to the fraudster.

Header or envelope spoofing

The underlying delivery information is manipulated so the message appears to pass through a trusted server. This is the form that most often survives a casual inspection, and it is the reason the full headers matter when a message is later analysed or produced as evidence.

What you see, compared with what is actually happening

What the law says

The Information Technology Act, 2000 is the first layer. Section 66D punishes cheating by personation by using a computer resource or a communication device, which fits a spoofed email used to impersonate a person or entity for gain. Section 66C covers identity theft, relevant where credentials or unique identifiers are misused. Section 66 generalises computer-related offences, and section 67 concerns obscene material in electronic form where a spoofed message also carries threats.

The Bharatiya Nyaya Sanhita, 2023 is the second layer. Section 318 covers cheating and section 319 covers cheating by personation, which apply where a spoofed email induces a payment or the disclosure of information. Section 336 covers forgery, engaged where a fake invoice, receipt or identity document is attached. Section 338 covers forgery for the purpose of cheating, which fits a spoofed demand for payment built on a manufactured document.

Procedure is the third layer. Under section 173 of the Bharatiya Nagarik Suraksha Sanhita, 2023 an FIR may be filed electronically, and it must be reduced to writing and signed where the informant appears in person. For the email itself, section 63 of the Bharatiya Sakshya Adhiniyam, 2023 sets out when an electronic record is treated as a document and what its certificate must state, which is why the full message, headers included, is stronger evidence than a screenshot of the visible text alone.

How to check whether an email is spoofed

Start with the address, not the name. Read the full email address character by character and compare the domain with the one you use for that party. Then open the message headers and look at the routing and the reply-to field, which often reveals an address that does not belong to the impersonated party. Check any link by hovering rather than clicking, and compare the destination domain with the visible text. For a payment request, verify by a second channel you already trust, such as a known phone number, never the number supplied inside the suspicious email.

What to do if you paid or replied

Preserve the full email, including the headers, and export it rather than forwarding it, because forwarding can alter the delivery path. Report to 1930 and cybercrime.gov.in if a payment was made, and notify your bank in writing the same day, asking for the beneficiary account to be placed on hold and the transaction treated as disputed. Where credentials were disclosed, change the password and enable two-factor authentication immediately, and check the account for rules or forwarding that the intruder may have added. Then file a police complaint under section 173 of the BNSS, attaching the exported message and the payment record.

What decides the outcome

Three factors decide whether a spoofing case moves and whether money is recovered. The first is whether the original message was preserved; a forwarded copy is weaker than the unedited original with its headers. The second is the speed of the freeze, since spoofed payment requests are usually cashed out quickly. The third is whether the victim's own conduct, such as clicking a link and entering credentials, allowed the loss to happen in a way a bank may treat as contributory negligence.

Common mistakes

• Deleting the spoofed email after realising it was fake.
• Forwarding the message instead of exporting the original, which can alter the headers.
• Calling a number printed inside the suspicious email to verify it.
• Sharing an OTP or a password to "confirm" an account after a spoofed alert.
• Paying a spoofed invoice and only then checking the domain.
• Reporting weeks later, when the funds and the mailbox logs have both gone cold.

How a spoofed payment request actually runs

The common sequence is short and deliberate. The fraudster first studies a relationship: a vendor who invoices regularly, a landlord, a client, or a senior colleague who approves transfers. A message then arrives from a name the recipient recognises, often with a plausible reason for a change of bank details, an urgent payment before a deadline, or a request to keep the matter confidential. The reply-to address is set so that any reply goes to the impersonator, and the thread may quote earlier genuine correspondence to look continuous. By the time the recipient notices the domain, the money has left.

Why the headers matter more than the screenshot

A screenshot proves what the message looked like, not where it came from. The headers record the servers that handled the message, the return path and the authentication results attached by the receiving service. Those details are what allow an investigator to trace the origin and what allow a court to see that the visible sender was not the actual sender. This is why the instruction to export rather than forward is not a technical nicety; it is the difference between a document that proves impersonation and one that merely describes it.

The business email compromise variant

Where the target is a company rather than an individual, the same technique is used against finance and accounts staff. A spoofed message from a director or a supplier directs a payment to a new account, or asks for a batch of invoices to be settled urgently. The loss is larger, the internal approval trail becomes evidence, and the company's own verification procedure is scrutinised. In such cases the company should preserve mailbox logs, approval records and the payment instruction, and should report to the cyber cell as well as to its bank, because the question of who authorised the transfer will decide both the criminal complaint and any insurance claim.

What mail providers and banks can supply

A mail provider can supply delivery logs, authentication results and the mailbox audit trail for the account that received the message. A bank can supply the debit record and, on a proper request, the details of the beneficiary account. Neither will release these to a victim on request alone; the investigating officer's written demand is what unlocks them. Asking for the right records early, in writing, is therefore part of the victim's job, not only the investigator's.

Protecting yourself after the first contact

Once you suspect a spoofed message, stop replying on that thread. Use a contact detail you already hold, such as a number saved in your own records or a number published on the organisation's official site, never one printed in the suspicious email. If credentials were entered on a linked page, change the password everywhere it was reused and enable two-factor authentication. Tell anyone who might receive a similar message, particularly colleagues or family members whose names were used, so they do not act on a follow-up.

Where to escalate in West Bengal

In Kolkata and the districts, a spoofing complaint can be filed with the cyber cell and, where escalation is required, pursued before the Bankshall Court or the City Sessions Court, with the Calcutta High Court as the supervisory court for the state. Where a police station declines to register the FIR, an application can be moved before a magistrate under the BNSS. A cyber crime lawyer in Kolkata can prepare the section 63 certificate that makes the exported email usable and align the bank and police tracks. For the surrounding offences and procedures, see the cyber crime blog.

Why victims wait, and why they should not

Many victims delay because the message looked genuine and they feel foolish, or because they assume the bank will notice the fraud on its own. Neither reason helps. The bank acts on your report, not on its own suspicion, and a mail provider preserves logs only for its own retention period. The earlier the report, the more of the trail survives. Feeling embarrassed is a poor reason to lose a freeze window that closes within a day.

When to involve a lawyer

Involve a lawyer when a payment was made, when a spoofed message led to a data or credential breach, when the bank has rejected a liability claim, or when the police have not registered an FIR despite a written complaint. A lawyer can draft the bank notice, move the magistrate application, and build the electronic-records certificate for the exported emails. Early preservation of the original messages, with their headers intact, is what makes every later step possible.

Frequently asked questions

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Related articles

• Hacking of email: what it is and how the fraud actually runs
• Business email compromise what it is and how it works
• Matrimonial fraud: what it is and how it actually runs
• Trading app scam: what it is and how the fraud runs
• Stock market scam: how the fraud actually runs in India
• Sextortion: What It Is and How the Fraud Actually Runs

Cyber crime lawyer in your city · Bank account freeze help · Contact