Someone is sending fake emails as me. What do I do?
First rule out a hacked mailbox: change your password from a trusted device, turn on two-step sign-in, and look for forwarding rules and sent messages you didn't create. If your email administrator's check also comes back clean, someone is spoofing your address. A DMARC policy on your domain, backed by SPF and DKIM, is the lasting fix.
How do I tell a hacked mailbox from spoofing?
There are two very different situations. In one, someone has your password and is using your real account. In the other, someone types your address into the “From” line of their own email without ever touching your account. Check for the first before assuming the second.
Step 1: check your account.
- Change your email password from a device you trust.
- Turn on two-step sign-in. See should I turn on two-factor authentication.
- Look for inbox rules and forwarding you didn’t create. Attackers often forward copies of your mail elsewhere or hide replies in an odd folder.
- Check Sent Items for messages you didn’t send.
- Sign out of all other sessions, if your provider offers it.
If you find any of these, tell your email administrator now. In Microsoft 365 or Google Workspace they can review recent sign-ins and lock things down.
Step 2: if nothing turns up, ask your email administrator to confirm it’s spoofing. A clean inbox doesn’t prove it: an attacker can delete sent mail or keep access through a connected app, an app password or delegated access. In Microsoft 365 or Google Workspace, an administrator can check sign-ins, message logs, connected apps and delegates. If those are clean too, it’s spoofing. Email was designed without a built-in way to check the sender, which is why SPF, DKIM and DMARC exist. Once DMARC is set to quarantine or reject, receivers that honor it filter mail that fakes your exact domain. Read what SPF, DKIM and DMARC are.
The short version
- Assume your mailbox is compromised until you’ve checked it.
- Change the password, turn on two-step sign-in, and remove any forwarding or rules you didn’t set.
- If an administrator’s check of sign-ins, apps and delegates is also clean, it’s spoofing: fix it with SPF, DKIM and DMARC.
- Warn affected customers and confirm bank details only by phone.
Why does it matter?
Fake invoices and “new bank details” emails are a common route to real losses for small businesses and their customers. The FBI’s Internet Crime Complaint Center lists business email compromise among the frauds it takes reports on.
What are the common mistakes and edge cases?
- Assuming it’s spoofing without checking. A hidden forwarding rule can keep leaking mail for months.
- Look-alike domains. Some scammers register a name one letter off from yours, or use a free email account with your business name. DMARC can’t stop those, because they aren’t your domain.
- Reply-to tricks. A message can show your address but send replies somewhere else. Tell customers to check the address they’re replying to.
- Changing only one password. If you reused it elsewhere, change it there too. See how to manage business passwords.
What if it keeps happening?
If fake mail continues after DMARC is at quarantine or reject, check whether it uses your exact domain or a look-alike. For your exact domain, read the DMARC reports to see which servers are sending; one may be a forgotten service you need to add. For look-alikes, report the domain to its registrar and warn customers. If money was sent, call the bank straight away.
How much does it cost, and how long does it take?
Checking your account takes under an hour. The email records cost nothing to publish. Moving DMARC to a strict policy safely takes longer, because every real service that sends for you has to pass first.
How does E-3 handle this?
You can see what your domain has today with the free email deliverability checker, or call 814-399-4655 if fake mail is going out right now.
Related questions
Common questions
- Should I warn my customers?
- If people may have received fake invoices or payment requests, yes. Tell them briefly what happened and to confirm any change of bank details by phone.
- Can I stop all fake emails using my name?
- DMARC makes it much harder to fake your exact address. It can't stop look-alike domains or free accounts using your name, so customers should check the full address.
- Where do I report a fake payment request?
- Call your bank first if money moved. In the US, the FBI's IC3 takes reports of business email compromise and other online fraud.
Rather talk it through?
Call our team, or send a note and we’ll reply within one business day. No pressure and no jargon.