Exact Display Name Masquerading in Inbound Email

Ethan Andrews@eandrews

•updated Jun 9, 2026•4•0•16

Detects inbound external emails where the sender's display name exactly matches the recipient's display name. This is a common social engineering tactic used to create a false sense of familiarity, making the recipient more likely to trust the email and its contents. The rule specifically excludes legitimate self-sent emails where the sender's and recipient's email addresses also match.