Trust built by familiarity, exploited by forgery
A legitimate system notification — a security alert, a password-reset prompt, an approval request — earns quick, low-scrutiny trust from recipients precisely because it looks familiar and comes through an expected channel. Notification spoofing exploits exactly that habit, crafting a forged message designed to look like the real thing in order to get the recipient to act on it — click a link, approve a request, reveal a credential — without applying the scrutiny they might give an unfamiliar message.
The attack doesn't need to compromise the notification system itself; it only needs to be convincing enough that the recipient doesn't distinguish it from the real thing before acting on it.
Making the legitimate version hard to imitate
Defending against this means making legitimate notifications distinguishable in ways that are structurally hard to forge, rather than relying on recipients to catch a forgery through vigilance: consistent, recognizable formatting the recipient learns over time, verifiable links rather than embedded one-click actions, and a channel choice that makes spoofing meaningfully harder to pull off convincingly. Authorization for who may trigger a notification in the first place — restricting that capability and monitoring its use — is the other half of the same defense, closing off the legitimate system itself as a vector for sending convincing forgeries.