One Quarter of Government Email Addresses Are Faked

In a recent report from the company Agar, it was found that about 25% of email messages that claim to be from federal agencies are in fact, phishing…and malicious to boot. They spoof, or change, the names to make them appear as if they are from authentic sources, hoping users will click on links or attachments contained within them.

Spoofing government email domains tends to work well, because people usually believe the message is coming from a trustworthy source. However, any unsuspected attachments or links sent in email should be met with a bit of suspicion, regardless of who the sender appears to be.

It’s not difficult to change the sender’s name to make it appear a message is from someone else. Phishing scammers use this technique regularly. They use names from your address book that were stolen from a previous breach or purchased on the dark web. They also use names of vendors that you may do or have done business with at some point. Often, these come with attached fake invoices with a link to click.

Unfortunately, federal agencies are sometimes (or even often) behind schedule when it comes to updating their products. In fact, a product called Domain-based Message Authentication, Reporting, and Conformance (DMARC) was mandated by the Department of Homeland Security to be installed on all federal email systems by the beginning of next year. This is a security product that is installed on approximately 85% of consumer email, including Gmail, Yahoo, and Outlook. However, about 82% of government email inboxes seem to be missing it to date. It must be installed at both the sender and recipient ends to be effective. So just because your Gmail account may be protected, it is no guarantee that the sender’s account is, which is why you cannot let your guard down when it comes to phishing.

Even if DMARC does get implemented at federal agencies in time, remember that these agencies will not initiate dialogue with anyone using email. They start by sending an old-fashioned paper letter via U.S. Postal Service.