---
sourceDocument: Zurich Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/security-management

 Release :

    - zurich

ft:locale :

    - en-US

ft:publication_title :

    - Zurich Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Playbook for Spoofed Emails (using the same Display name)

# Playbook for Spoofed Emails (using the same Display name) {#ariaid-title1}

* Release version: Zurich
* 
* Updated July 31, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

This playbook provides systematic remediation steps to investigate Spoofed Emails, which get triggered when spoofed names for emails are sent to the organization's employees.
* **[Set up the Spoofed Emails playbook](https://www.servicenow.com/docs/Mtye9fayFyQY5aJQvYhxYg)**   
  Use the following steps to set up the Spoofed Emails playbook.
* **[Use the Spoofed Emails (using the same Display name) playbook](https://www.servicenow.com/docs/X9zHZbs2hyXg1M1c7NiApw)**   
  Use this playbook to investigate Spoofed Emails, which get triggered when spoofed names for emails are sent to the organization's employees. The following steps give you a walkthrough of the actions, tasks, and subflows that are available in the Spoofed Emails (using the same Display name) playbook.