The Copy

She's not drawing from imagination.

Spoofing is the art of the convincing copy. The attacker studies the legitimate version — the bank's email template, the login page's exact layout, the sender's display name — and reproduces it with enough fidelity that the recipient doesn't look twice. The goal isn't perfection. It's plausibility. Close enough to pass a glance.

The technique predates computers. Forgers study originals. Con artists study marks. The tradecraft is the same: spend enough time with the real thing that your reproduction carries its credibility. Most people don't scrutinize what already looks familiar.

What makes spoofing effective isn't technical sophistication — it's the human tendency to pattern-match and move on. An email that looks like it's from IT gets clicked. A login page that resembles the real one gets credentials entered. The copy doesn't have to be perfect. It has to be good enough for the second it takes someone to decide.

She's working from reference. So is the attacker.