A display name is not an email address
The name your email client shows you is just a label. Whoever sent the message chose it.
Anybody can put "HR Department" or your chief executive's name in that field, and on a phone the actual address is usually hidden entirely. That is the whole trick behind a large share of business email fraud: no technical flaw, no spoofing, simply a display name that says one thing and an address that says another. Checking the real address takes a second on a computer and a deliberate tap on a phone, which is why the phone is where it works.
More on Email security
- DKIM protects signed content against later modificationChange one word, break the seal
- DMARC depends on alignmentBoth names, or neither
- Forwarding can break email authentication assumptionsIt was re-posted on the way
- Reply-chain hijacking borrows existing trustTrust borrowed from the thread
- Secure email gateways see only traffic that reaches themIt only sees what comes past it
- Quarantine creates a second security decisionHeld is not decided