Hacker News Reader

You do not need to compromise anything, you can put any address in the "from" field. Email has no universal verification for sender address.

View on HN

I would sincerely hope .gov addresses use SPF/DKIM/DMARC. That makes spoofing impossible. In Revolut's case, the sender's email system had been compromised.

And what about the rest of the world?

Reply on news.ycombinator.com