You open your inbox and see an email from someone you recognize.
It might appear to be from your CEO, accounting manager, administrator, or another employee. Their full name is correct. The message might even reference something that sounds relevant to your organization.
But then you look more closely.
The email address isn't theirs.
It's an increasingly common phishing technique, and one of the first questions we hear is:
“How did they know our employees' names? Have we been hacked?”
The good news is that, in many cases, no account has been compromised at all.
What you may be seeing is called display-name impersonation.
Email messages contain both a display name and an email address.
For example:
John Smith[email protected]
The person sending that message may completely control the Gmail account, but they can configure the display name to say “John Smith.”
This becomes particularly effective because email applications, especially on phones, often make the sender's display name much more prominent than the underlying email address.
An attacker therefore doesn't need access to John Smith's actual mailbox to create an email that initially appears to have come from him.
Microsoft's security community discusses this type of attack as display-name spoofing, where a legitimate user's name is displayed even though the sender is using an entirely different email address or domain.
This is usually the part that concerns people the most.
The reality is that employee information can be surprisingly easy to discover without ever touching your organization's systems.
Names, positions and relationships between employees may be available through:
Attackers gather information from these sources and use it to create convincing phishing messages.
In other words, knowing your employees' names does not necessarily mean someone has gotten into your network or your Microsoft 365 environment.
This distinction is extremely important.
You receive:
Jane Smith[email protected]
Jane really works at your organization, but that isn't Jane's email address.
The attacker has simply discovered Jane's name and used it as the display name on another email account.
This does not, by itself, indicate that Jane's Microsoft 365 account has been compromised.
A more sophisticated message may try to make itself appear as though it originated from your organization's actual internet domain.
This is one reason technologies such as SPF, DKIM and DMARC are important components of modern email security. They let receiving mail systems check whether a message claiming to come from your domain was really sent by a server you authorized.
Microsoft 365 also uses spoof intelligence as part of its protection against phishing and sender spoofing.
This is the situation that requires a different level of investigation.
If an attacker actually obtains an employee's credentials or sign-in session and sends messages through the legitimate account, the messages really are originating from that user's mailbox.
That requires a proper investigation rather than simply treating the message as ordinary display-name spoofing.
The important takeaway:
An email using an employee's name is not proof that the employee's account has been hacked.
Phishing isn't always the poorly written, obviously fraudulent email many people still expect.
Modern phishing attempts can look professional and may imitate ordinary business conversations. Attackers research organizations before contacting them and then impersonate the people employees are most likely to recognize.
Common themes include requests involving:
The objective is to get the recipient to act quickly, before they carefully inspect who actually sent the message. Our earlier post on how to spot and deal with phishing emails covers the warning signs in more detail.
Not necessarily.
SPF, DKIM and DMARC are extremely important, but there is a difference between spoofing a domain and impersonating someone's display name.
Consider this:
From: John Smith <[email protected]>
The attacker may legitimately control someotherdomain.com.
The email can authenticate correctly for that domain while the attacker simply sets the friendly display name to “John Smith.” Domain authentication did its job. The domain just wasn't yours.
This is why organizations need layers of email security instead of relying exclusively on domain authentication. Microsoft 365's spoof intelligence and impersonation protection exist to catch senders attempting to spoof users and domains that authentication alone can't flag.
There isn't one setting that eliminates phishing.
Effective protection combines technology, configuration and employee awareness. Organizations should consider:
Configure and maintain SPF, DKIM and DMARC for every domain your organization sends from, and review them when you add a new service that sends email on your behalf.
Microsoft 365 environments should have anti-phishing policies configured to identify impersonation attempts, including protected users and protected domains.
Executives, accounting personnel and other employees frequently targeted for impersonation deserve particular attention when configuring identity and email protections, including multi-factor authentication and conditional access.
Employees should be able to recognize at a glance when a message originated outside the organization, for example with an external-sender tag in the subject line or message header.
Technical controls will never catch every malicious message. Employees need to know that recognizing someone's name isn't enough. Check the actual email address. Ongoing security awareness training keeps that habit fresh.
Employees should know exactly how to report a suspected phishing message through your organization's approved process, rather than replying to it, forwarding it around the office, or quietly deleting it.
If an email arrives using the name of your CEO, coworker or accounting manager but originates from an unfamiliar address, don't immediately assume your network has been breached.
Instead:
Cybercriminals don't have to hack your company to impersonate it.
Sometimes all they need is a name.
Publicly available information can give attackers enough material to construct surprisingly believable phishing messages. Combined with display-name impersonation, an attacker can make a message initially appear to come from someone an employee knows and trusts.
That's why modern cybersecurity requires more than firewalls and passwords. It takes a combination of email authentication, Microsoft 365 security controls, identity protection, monitoring and educated employees.
And most importantly: if you suddenly begin receiving emails carrying the names of real employees, don't assume you've been breached, but don't ignore them either.
A proper examination of the message and its email headers can usually tell your IT provider a great deal about what is actually happening.
Reality Bytes helps Alberta organizations protect Microsoft 365, email, identities and users against modern threats through our managed cybersecurity services.
If you're seeing suspicious emails, executive impersonation or targeted phishing campaigns, get in touch. We can determine what's actually happening and make sure the appropriate safeguards are in place.
Antivirus, EDR and MDR explained in plain language, and why antivirus alone no longer protects Alberta and Canadian businesses from ransomware and modern attacks.
October 13, 2026
Most data breaches start with human error. Learn why cybersecurity education matters for your business in 2026, and how Reality Bytes trains teams.
February 10, 2026
Disasters happen. Learn the business continuity steps that keep your operation running through outages, ransomware and the unexpected.
February 3, 2026