Glossary
Notification Spoofing
Notification spoofing crafts a message designed to look like a legitimate system alert or notification — a password-reset prompt, a security warning, an approval request — in order to exploit the trust a real one would carry and prompt the recipient into acting without the scrutiny they might apply to an unfamiliar message. The attack works precisely because recipients are conditioned to treat notifications from a known, trusted source as informational rather than as something to independently verify.
Defending against it means making legitimate notifications distinguishable in ways that are hard to forge — consistent formatting the recipient learns to recognize, verifiable links rather than embedded actions, and channels that make spoofing structurally harder, rather than relying on the recipient to catch a forgery through vigilance alone.