The Letter That Isn't: How Homoglyph Attacks Fool Your Eyes

If you’ve sat through any phishing training in the last ten years, you’ve heard the same advice: check the sender’s address, read the domain carefully, and hover over a link before you click it.

That advice still catches a lot of scams, and you should keep following it. But there’s one kind of attack it can’t catch, and it’s worth understanding why. In a homoglyph attack, the scammer uses a domain that’s spelled differently from the real one but looks exactly the same on screen. You can read it slowly, letter by letter, and still get it wrong, because every letter you’re looking at is the right shape.

Below we’ll walk through how these attacks work, why your email filter may wave them right through, and the handful of habits and settings that stop them anyway.

What a Homoglyph Is

A homoglyph is simply a character that looks like another character. Some of them are close but not perfect. An “r” and an “n” sitting next to each other read as an “m” at a glance, a capital “I” passes for a lowercase “l,” and a zero passes for the letter “O.” You can catch these if you slow down, which is exactly why attackers count on you not slowing down.

Others are perfect. The internet supports domain names in almost every writing system, which is a genuinely good thing for the billions of people who don’t write in English. The side effect is that some letters in other alphabets are drawn exactly like ours. The Cyrillic letter “а” and the Latin letter “a” are two different characters that most fonts render identically, so if you swap one for the other in a domain name, you get a brand-new domain that looks just like the original.

Behind the scenes, a domain with non-English characters gets stored in a format called Punycode, which always starts with xn--. That’s the version computers actually use to route mail and web traffic. It’s rarely the version you see.

What It Looks Like

The most common version is a vendor’s address that’s one letter off. An invoice or a “revised payment details” message arrives from what looks like a supplier you pay every month, and nothing about it seems unusual, except that the domain is a look-alike the attacker registered last week.

Another favorite is the coworker who isn’t one. A message seems to come from your own company’s domain asking for a quick favor, like buying gift cards, approving a payment, or reviewing a document. The domain is your company name with a single letter swapped.

Then there are links. The text of a link in an email can say anything the sender wants, and the address it actually opens can use the same swapped letters to drop you on a sign-in page that looks exactly like the one you use every day.

Why Filters and Browsers Miss It

The first problem is that the domain is real. Most of the checks email systems use to spot a forged sender, such as Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting and Conformance (DMARC), are there to confirm that a message actually came from the domain it claims to come from. A homoglyph domain isn’t forged at all. The attacker owns it and sets it up properly, so it passes those checks without any trouble.

Browsers do better, but they don’t catch everything. Modern browsers, including Chrome, will show you the xn-- form of an address when a domain mixes alphabets, like the Cyrillic example above, or when it closely resembles a widely visited site. That’s real protection, and it’s a big part of why a fake bank or big-tech login page often gives itself away in the address bar. The catch is that the resemblance check leans on lists of popular domains. A look-alike built from accented letters (summitmachiné.com, say) can display completely normally if the business it’s imitating isn’t on one of those lists, and your accounting firm, your supplier, and your own company name generally aren’t.

Email gets even less protection. The sender line, the display name, and the link text are all just text, and nothing guarantees your mail program will show you the xn-- version. Display names in particular can be set to anything the sender likes.

Habits That Stop Most of It

Since careful reading can’t win this one, the answer is to stop relying on your eyes and let a few habits do the checking for you.

1. Let your password manager decide. A password manager saves each login for the exact domain you created it on, and it doesn’t care what the page looks like. So if it doesn’t offer to fill in your password on a page that seems familiar, treat that as a red flag and stop. Typing or pasting the password in by hand to get around it is exactly what the attacker is hoping you’ll do.
2. Use bookmarks for anything that matters. For banking, payroll, Microsoft 365, and vendor portals, go in through a bookmark or type the address yourself instead of following a link from an email.
3. Verify by phone, using a number you already have. Any request that involves money, bank details, or a sign-in should be confirmed with a quick call to a number you know is real, not one from the message. A perfect-looking address doesn’t prove anything anymore.
4. Take the warnings seriously. If your email marks a message as external, or warns that the sender has unusual characters or is someone you don’t usually hear from, and the message claims to come from a coworker or regular contact, treat it as suspect until you’ve confirmed it.
5. Use phishing-resistant sign-in where you can. Passkeys and hardware security keys are tied to the real site’s domain, so they simply won’t complete a sign-in on a look-alike page, however convincing it is.

What to Ask Your IT Team

If you’re not sure how your own setup handles this, these are good questions to bring to whoever runs your IT.

• Is impersonation protection turned on for our domains and our key people? In Microsoft 365, Microsoft Defender for Office 365 anti-phishing policies can protect specific domains and users, and can show a safety tip when a sender’s address contains unusual characters. The people to protect have to be named in the policy, though, and the protections only help once someone has actually set them up.
• Do messages from outside the company get labeled as external? Exchange Online can tag external senders in Outlook, which makes a “coworker” writing from a look-alike domain much easier to spot.
• Is the first contact safety tip turned on? It lets people know when they don’t usually get mail from a sender, which is exactly the situation with a brand-new look-alike domain.
• Are we watching for look-alikes of our own domain? Keeping an eye on new registrations, and buying the most obvious variants yourself, cuts off attacks that impersonate you to your own customers.
• Do our phishing simulations include look-alike domains? Training that only ever uses obvious fakes teaches people to spot obvious fakes.

The Bottom Line

Homoglyph attacks get around the oldest piece of phishing advice there is, because no amount of careful reading can tell two identical letters apart. The good news is that you don’t have to. Let the password manager, the bookmark, and the phone call do the checking, and the look-alike stops mattering. If you’d like a second set of eyes on how your email and sign-in settings handle this, get in touch.