Display-name spoofing
Putting a trusted name in the display-name part of the From header over an unrelated address, such as "Example Bank" <random@freemail.example>.
What it means
Many mail apps, especially on phones, show only the display name. An attacker writes the name of a colleague, an executive or a brand and sends from any address they control, often a free mailbox that passes all authentication.
RFC 9989 names these display name attacks and states that they are out of scope for DMARC, which only evaluates the domain of the address. Receivers counter them with impersonation detection on names, as in Microsoft Defender's user impersonation protection, and with warnings such as first-contact tips and external sender tags.
Showing the full address, and treating unexpected requests from familiar names with suspicion, remain the practical user defences.
Example
From: "Example Bank Security" <alerts.examplebank@freemail.example>Related terms
Sources
What this definition rests on. The wording is ours; the facts are theirs.
All 432 terms in the glossaryThe wiki: blocklists and bounce codes