How it works
Every mail client shows the display name in big letters and the real address in small ones, or hides the address entirely until you tap the name. Display-name spoofing abuses that gap. The scammer sets the from-name to something like "Robinhood Partnerships," or even puts "partnerships@robinhood.com" in the name field as a label, while the address that actually sent the mail is on a throwaway or unrelated domain. On a phone especially, you see the friendly name and never the real address. The name field is free to set to anything, so the brand it shows is worth nothing on its own. Finance apps like Robinhood are targeted because a "creator payout" or a "brokerage partnership" is a believable hook.
The tell-tale signals
- The display name shows one thing, the brand or a brand address written as text, while the real sending address is on a different domain. Expand the sender to see the actual address.
- The visible name may literally contain "@robinhood.com" as decoration, which is just a string in the name field, not the real sender.
- Reply-to, or the true address, lands on a domain unrelated to robinhood.com.
- The domain that actually sent it may be young and poorly authenticated.
What to do
Tap or click the sender name to reveal the full address, then judge only that. Do not trust the bold name your client shows first. If the display says Robinhood but the real address is on anything other than robinhood.com, it is spoofed. Confirm any offer through robinhood.com's own affiliate or creator contact. On mobile, be extra deliberate, because that is where the real address is easiest to hide. If the address and the name disagree, do not reply, and report it.