Attackers do not always need to compromise an email account to trick recipients. By simply using a trusted person's name as the display name while sending from a completely different email address, attackers can make users to act on fraudulent requests.

Zoho Mail's Display Name Spoofing protection allows administrators to define which email addresses are authorized to use specific display names. This ensures that any email using those names from an unauthorized address is flagged or quarantined before it reaches users.

What is Display Name Spoofing in Zoho Mail? 

Display Name Spoofing is a phishing technique where an attacker impersonates a trusted person, such as a CEO or manager, by using their display name while sending from a completely different and unauthorized email address. Since most email clients prominently show the display name rather than the email address, recipients may not notice the discrepancy and act on the fraudulent request.

For example, if your organization's CEO uses ceo@zylker.com, an attacker could send an email with the display name "CEO" from a completely different email address. Without Display Name Spoofing protection, this email would appear to come from the CEO, potentially deceiving users into sharing sensitive information or making unauthorized transactions.

How can administrators use Display Name Spoofing protection effectively in Zoho Mail Admin Console? 

Display Name Spoofing protection in Zoho Mail gives administrators the ability to map specific display names to their authorized email addresses and define how unauthorized emails are handled.

• Protect key employee identities: Add the display names of key employees such as the CEO, manager, or finance head, along with their authorized email addresses. Any email using those display names from an unauthorized address will be automatically flagged or quarantined.

• Add users with aliases: For users with alias email addresses, administrators can add the user's primary email address along with all their alias addresses in a single step, without having to enter each address manually.

• Define delivery actions: Choose the action to be taken on emails with spoofed display names: move to spam, move to quarantine, or take no action, based on the organization's requirements.

Steps to configure Display Name Spoofing protection in Zoho Mail Admin Console 

1. Log in to Zoho Mail Admin Console.

2. Navigate to Security and Compliance in the left pane.

3. Select Phishing and Malware and click Display Name Spoofing.

4. In the Email Delivery Action section, select the action to be taken for emails with spoofed display names: None, Move to spam, or Move to quarantine.

5. Click Add and select Add using email addresses.
   

6. Enter the display name and the email addresses that are authorized to use this name, and click Add.