wize.

INSIGHTS · EXPLAINED

All Insights

Lookalike domains: when letters deceive the eye

A name can look familiar while being different. A substituted letter, an added word or a character from another alphabet may be enough to cause confusion.

By Wize2 min readPublished on Updated on

Resemblance is not identity

Unicode documents visual similarities between characters, including across writing systems. A Latin character and a Cyrillic character can look very similar without being the same character. The document also explains that resemblance depends partly on the font used.

Source : Unicode — UTS #39, Security Mechanisms, revision 34

Not every trap is sophisticated

An attacker does not need another alphabet to mislead a hurried reader. A discreet typo or a reassuring word added to a familiar name can distract attention. An email display name does not establish that its address belongs to the business it claims to represent.

Browsers have protections for displaying some internationalised names. This does not mean every resemblance will be detected in every application.

Source : Chromium — internationalised domain display rules

Slow down when the stakes rise

If a message asks you to change bank details, enter a password or make an urgent payment, check before acting. Use a trusted bookmark or reach the service through an independent route. For a bank account change, call an established contact using the number you already had before the message.

Explain this habit to the people handling invoices and customer enquiries in your business. Registering a few useful variants of your name may reduce some confusion, but cannot cover every possible resemblance.

The aim is not to make every email suspicious. It is to recognise the moments when one extra check can prevent a rushed decision.

Put it into practice

Explore the related Wize guide
Sources

Keep exploring