I just pulled Foundation's public email records (DNS TXT), which is where the answer starts: - foundation.xyz: SPF allows Google and Mailgun (~all), DMARC is p=quarantine at 100%. - foundationdevices.com: DMARC is p=reject. So a true forgery of an @foundation.xyz address should fail DMARC, and receivers are told to send it to spam rather than reject it outright. That leaves three usual ways these "look legit": 1. Display-name spoofing: the From shows "Foundation" but the actual address is some other domain. Most phone mail apps hide the address, so this is the most common trick. 2. Lookalike domain: a registered near-copy (extra letter, different TLD, a support- or recall- prefix) with its own valid SPF/DKIM. It passes every check because it's really their domain, not Foundation's. 3. Real forgery of foundation.xyz that failed DMARC but still landed in someone's inbox because quarantine is a softer policy than reject, or the mail provider ignored it. To tell which one: open the email, use "Show original" (Gmail) or "View source", and look at the From address character by character and the Authentication-Results line (spf=, dkim=, dmarc= pass/fail, and which domain each passed for). If dmarc=fail on foundation.xyz, it's #3, and Foundation moving that domain to p=reject would cut it off. If everything passes for a different domain, it's #2. Either way the rule holds: no real vendor recall asks you to move funds or enter your seed.