When mail is sent via SMTP, there are two separate places this sort of information goes, the Envelope (things that are set with SMTP commands) and the Header (the first block of text under the SMTP Data command, ending with a blank line). So, for example, here is an SMTP transaction where the Envelope disagrees with the Headers. The message will get delivered per the Envelope, but the recipient will see the headers.
mail from: <evil@evil.com>
250 2.1.0 Ok
rcpt to: <victim@example.com>
250 2.1.5 Ok
data
354 End data with <CR><LF>.<CR><LF>
From: "Apple Store" <apple@apple.com>
To: orders@apple-store.com
Subject: We just received your purchase...
Mail body goes here.
.
250 2.0.0 Ok: queued as C5E251FFE2
quit
221 2.0.0 Bye
Connection closed by foreign host.
The fake recipient goes in the header "To:" line, but the mail is delivered according to the value set in the SMTP "RCPT TO" command. And indeed, the recipient sees the Header that the attacker wanted them to see:
![Mail client view of forged email](../../images/3793816651.webp)
Now, there is some protection against this. If you tell your mail client you want to view the full mail headers, you'll note that the mail server injected an several headers that tell the true story:
From evil@evil.com Fri Jul 27 14:45:21 2018
Return-Path: <evil@evil.com>
X-Original-To: victim@example.com
Delivered-To: victim@example.com
But, of course, mail clients always hide this level of detail by default, and interpreting headers correctly can be difficult. The key to remember is that they are prepended by servers as they go along, so the ones that the top are put in by your server; if you see "Return-Path" at the bottom of the headers it's likely forged by the attacker to try and misdirect you... Since the original message 'data' contains headers crafted by the sending client, they can put whatever they want in there before the servers start prepending.
As per how to do it -
The first rule of email recipient forgery is, expect it to fail miserably.
The second rule is, use Bcc: for the recipients you want to get it, and To: for recipients you want to be seen getting it. This is the standard way of doing this with a mail client, and generally works with everything from mailx to gmail.
But mileage may vary unpredictably. For example, if you leave To: blank, many mail servers will stuff the contents of Bcc: into To: to make up for it. 20 years ago I spammed thousands of "hidden recipients" with each other's addresses that way, sending out a contest update to the list of applicants. OOPS.