Back to Checks
googleworkspace

Protection against spoofing of employee names is enabled

gmail_employee_name_spoofing_protection_enabled
Service: gmailSeverity: medium
OfficialBuilt-inVerified
Categories:email-security
Resource Type:NotDefined

Verifies that Gmail moves out of the inbox, to spam or quarantine, the emails whose sender display name matches an employee's name but come from an external address. An action that only shows a warning is not enough. This is a common social engineering technique where attackers impersonate colleagues or executives.

Prowler logoProwlerprowler-provider-googleworkspace

Risk

Without protection against employee name spoofing, users may receive emails that appear to come from colleagues or executives but are actually from external attackers. This enables business email compromise (BEC), wire fraud, and social engineering attacks that exploit trust relationships.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler googleworkspace --checks gmail_employee_name_spoofing_protection_enabled

Recommendation

Enable protection against spoofing of employee names and configure an appropriate action such as moving to spam or quarantining.

Remediation

Other

1Sign in to the Google **Admin console** at https://admin.google.com
2Navigate to **Apps** > **Google Workspace** > **Gmail**
3Click **Safety** > **Spoofing and authentication**
4Check **Protect against spoofing of employee names**
5Select the desired action (e.g., Move email to spam)
6Click **Save**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGoogleWorkspace
from prowler.providers.googleworkspace.services.gmail.gmail_client import gmail_client
from prowler.providers.googleworkspace.services.gmail.lib.spoofing import (
    describe_consequence,
    is_protective,
)


class gmail_employee_name_spoofing_protection_enabled(Check):
    """Check that protection against spoofing of employee names is enabled.

    This check verifies that Gmail is configured to take action on
    emails where the sender name matches an employee name but comes
    from an external address, helping prevent social engineering attacks. CIS requires the configured
    action to move the message to spam or quarantine it, so an action that
    only shows a warning is reported as a failure.
    """

    def execute(self) -> List[CheckReportGoogleWorkspace]:
        findings = []

        if gmail_client.policies_fetched:
            report = CheckReportGoogleWorkspace(
                metadata=self.metadata(),
                resource=gmail_client.policies,
                resource_id="gmailPolicies",
                resource_name="Gmail Policies",
                customer_id=gmail_client.provider.identity.customer_id,
            )

            enabled = gmail_client.policies.detect_employee_name_spoofing
            consequence = gmail_client.policies.employee_name_spoofing_consequence
            domain = gmail_client.provider.identity.domain

            if enabled is False:
                report.status = "FAIL"
                report.status_extended = (
                    f"Protection against spoofing of employee names "
                    f"is disabled in domain {domain}. "
                    f"Enable the protection and set the action to move the "
                    f"email to spam."
                )
            elif not is_protective(consequence):
                report.status = "FAIL"
                report.status_extended = (
                    f"Protection against spoofing of employee names "
                    f"{describe_consequence(consequence)} in domain {domain}. "
                    f"The action should move the email to spam."
                )
            else:
                report.status = "PASS"
                state = "is enabled" if enabled else "uses Google's default (enabled)"
                report.status_extended = (
                    f"Protection against spoofing of employee names "
                    f"{state} with action '{consequence}' in domain "
                    f"{domain}."
                )

            findings.append(report)

        return findings

References