Why the friendly sender name is the easiest thing to fake

The name you see in bold at the top of an email — 'Your Bank', a colleague's name, even your own — is simply a display name. It is free text the sender chooses, and it is completely separate from the actual email address behind it.

Because many mail apps show the display name prominently and tuck the real address away, this is the most common and lowest-effort deception there is. A message can read as though it is from someone you trust while the underlying address is nothing of the sort.

A forensic analysis ignores the display name entirely and works from the addresses and routing that the mail servers recorded. If the friendly name and the underlying evidence disagree, the report says so plainly — and the machine-recorded evidence is what stands up when you escalate the matter.