Who steals my purse steals trash... / But he that filches from me my good name / Robs me of that which not enriches him / And makes me poor indeed. --William Shakespeare

Imagine this scenario: Hundreds of thousands of spam emails appear to come from... your company. The ensuing flood of bounces and complaints from recipients crash your server. Outraged addressees clog your phone lines. Business grinds to a halt. Days and dollars are spent salvaging your technology, soothing complaints, and doing damage control for your brand. It's called spoofing - and it could happen to you.

Spoof email forges the sender's identity to trick the recipient into opening it (or to trick a spam filter into delivering it). When recipients click on a link or attachment, they're off on a little trip to well-known circles in Internet Hell: Scam, Porn Site, Disinformation Campaign, or Virus.

Real-Life Spoofs
flowers.com (now 1-800-FLOWERS.COM). A student used the company's address in spam selling information on "free cash grants." Bounces and return-to-sender hate mail swamped flowers.com 's network and crashed its system.

Sony. A message "from" Sony's president threatening a hostile takeover of Apple Computer at an inflated per-share price landed at tech and finance companies from Silicon Valley to Wall Street.

Herbert Smith (law firm). An icily worded message "from" management informed employees a colleague had been brutally murdered, naming her replacement. Shocked staff forwarded the message to friends outside the company's London and Hong Kong offices. A viral global smear campaign rapidly unfurled. Microsoft. An attachment in a message "from" Microsoft was purported to be a software update. Those who clicked succumbed to the virus the "update" really was.

PayPal. A message, apparently from an AOL account, told recipients they had been paid $200. It linked to a fake PayPal page that collected their financial information. (Similarly, email "from" the American Red Cross following the September 11 disaster sent recipients to fake Web sites where people used credit cards to make "donations.") Warner Bros. A message "from" "warnerbros.au" linked to a porn site. (Computerworld magazine and many other media companies suffered similar fates.)

The How and Why of Spoof
Spam software can randomize the "from" line, so 1 million messages would not appear to come from a single source. Randomize enough names, and the software will occasionally spit out a real one, belonging to a real company - maybe yours.

There's some division of opinion on why spoofers choose the addresses they do. Margie Arbon, MAPS director of operations, says .edu addresses are used because universities often have open relays, so by cloaking yourself as a .edu you can get messages through them as if you were a legitimate user.

Then there are those spoofers who appropriate a real email address. "Phishers" will mock up an ISP's site and email you, telling you that a new ID needs to be entered, with a link to the fake page provided. Once they have your password, they hack your account and send email as you.

Coalition Against Unsolicited Commercial Email (CAUCE) board member and author John R. Levine says spoofing is technically no harder than "forging a return address on paper mail."

"I get a lot of bounces from mail I never sent," he told me, "but it's easy to explain to people I'm not a spammer. Customers are not that technically sophisticated. Spoofing is rarely done well - it doesn't look professional or sophisticated. But people say, 'Oh, how nice.' Click. Boom."

As time goes on, Levine predicts, marketers are going to get more upset about spoofing, for which he says Windows security flaws are largely to blame. "Customers' perception is: If you get spam, it's fraudulent. I didn't know this company is a bunch of crooks," Levine said.

Spoofers use company names because, as Levine puts it, "most individuals don't have an identity worth defaming. You could send rude things to someone's coworkers or mother. It's well known political spam has been sent by the opposition. People do fake press releases all the time. People are a long way from understanding the way email works."

Spoofers can be anyone. Spammers earn money sending massive volumes of email. They can be competitors trying to cripple your business or disgruntled employees or irate customers out to "teach you a lesson." Attacks can be personally motivated or just random.

Fighting Spoof
What precautions should you, as marketers, take against spoofing? What if your next bounced email is from you and you never sent the message? Levine, Joffe, and Arbon gave me some suggestions:

Be aware spoofing is possible and can happen to you (most executives have never heard of the practice).

Be on the lookout. Tell your IT staff to look for bounces of mail not sent by your company and to keep an eye out for complaints. An early-warning system is critical. After the first complaint or two, you're bombarded and it's too late.

Have an auto-reply form letter ready explaining what happened and that it's faked. That way, you won't have to write one in the middle of a crisis situation. Have a plan of action. Remember that, in the event of a spoof attack, marketing and PR are the front lines of defense.

Make it known you'll prosecute. Have a dedicated email address posted on your site for reports: abuse@ or piracy@. (Software companies who have set up a reporting structure for pirated software have seen declines in the practice.)

Don't keep quiet - whatever you do. Your company needs to acknowledge the problem, explain it to the aggrieved parties, and mop up external damage (even if internally you've taken a big hit).