Hacker News Reader

From and reply-to looks just like your company unless you catch the misspelling. "l" and "I" in the domain name go to different companies, but when everything else in the email looks just like any other email from IT you aren't going to notice that small difference - you probably won't even read the from/reply lines.

The address doesn't matter in some of these scams. It could be a message spoofed from your boss's real email address saying, "Hey Sam, I sent you the wrong account we need to wire money to. It's actually 123456. Can you fix that ASAP? Thanks!"

Sending addresses can be spoofed.

End users should never see emails that fail DKIM or SPF checks. Sender address spoofing is a solved problem.

If a company gets owned because they failed to implement SPF or DKIM properly, IT is at fault, not the employee.

But wouldn't you reply to the address it specified instead of the source of the spoofing? I thought that was why most phishing emails include a link rather than asking you to reply.