Someone is sending email from my address: spoofed or hacked?

A colleague asks why you sent them a strange invoice. Bounces arrive for messages you never wrote. A contact forwards you a "you've been hacked" email that appears to come from your own address. Two very different problems cause this: your address is being spoofed, or your account has been hacked. The fix depends on which one it is, so work that out first.

Spoofed or hacked: what's the difference?

Spoofing means someone put your address in the From line of a message sent from their own server. They never touched your account. Microsoft describes spoofed messages as ones that "appear to originate from someone or somewhere other than the actual source." Gmail Help says spammers can use your address as the sender or the reply-to address, and that because these emails are created outside Gmail, Gmail can't stop spammers from spoofing your address.

A hacked account means someone has your password or a valid session and is sending from your real mailbox. Those messages pass every authentication check, because they really did come from your account. That's why a hacked account is far more dangerous.

How do you tell if your email was spoofed or hacked?

Use this table. One strong "hacked" signal outweighs several "spoofed" ones.

1. Look in Sent Items and Deleted Items

If the messages are in your Sent folder, they were sent from your account. Microsoft lists suspicious messages in Sent Items or Deleted Items as a symptom of a compromised mailbox. An empty Sent folder isn't proof of safety, though: attackers can delete what they sent.

2. Check your sign-in activity

In a Google Account, review recent security activity and the devices signed in (Google Account Help). In Microsoft 365, an admin can review the Microsoft Entra sign-in logs for IP addresses, locations and times. The NCSC lists "logins or attempted logins from strange locations or at unusual times" among the signs of a hacked account.

3. Check rules, forwarding and settings

Attackers who get in often set up rules to hide replies or copy your mail. Microsoft's symptoms include rules that forward email to unknown addresses, rules that move messages to the Notes, Junk Email or RSS Subscriptions folders, recently added external forwarding, and changed signatures. Our guide to the signs an email account is compromised shows where to look in Microsoft 365 and Google Workspace.

4. Read the headers of a message someone received

This is the most reliable test. Ask a recipient to send you the suspicious message as an attachment, not a forward, so the headers survive. Then paste the headers into the free Email Header Analyzer, which runs in your browser.

• Spoofed: the Authentication-Results header shows DMARC failing for your domain, and the Received lines show servers you don't use. Microsoft 365 marks failed composite authentication as compauth=fail.
• Hacked: SPF, DKIM and DMARC pass, and the message came through your own provider's servers.

Our guide on how to read email headers explains each field.

5. Look at the bounces

Bounce messages for mail you never sent are usually backscatter: a spammer forged your address, and receiving servers sent their rejections back to you. Gmail notes that some spammers use software to create random lists of addresses to use in spoofing. Our guide to backscatter explains how to tell it apart from a real problem.

What should you do if your address is being spoofed?

Spoofing isn't a breach of your account, but it hurts your reputation and can fool your customers and suppliers. Stopping it is a domain-level job.

1. Check your domain's records. Run the free DMARC Checker and SPF Checker. With no DMARC record, or p=none, receivers aren't asked to act on mail that fails.
2. Make sure every real sender passes. Your mail platform, your website's contact forms, invoicing and marketing tools must all send with SPF or DKIM aligned to your domain.
3. Move DMARC to enforcement. DMARC (RFC 9989) lets you ask receivers to quarantine or reject mail that fails. Follow our staged path from p=none to p=reject.
4. Protect domains you don't send from. Parked domains are easy targets; see protecting parked domains from spoofing.
5. Warn contacts if the spoofing targets them. Tell customers and suppliers you'll never change bank details by email alone.
6. Report the messages as spam or phishing. Gmail's advice for spoofed bounces is to report them as spam.

DMARC only covers your exact domain. It can't stop display-name tricks or lookalike domains. Our guide to stopping spoofing of your domain covers the full setup.

What can DMARC reports tell you?

Once you publish a DMARC record with a rua address, receivers that support reporting send you aggregate reports. They list the IP addresses that sent mail using your domain in the From line, and whether each source passed SPF and DKIM. Your real platforms should pass. Unknown sources that fail are spoofing, or a legitimate service you forgot to set up. Reports are XML files; the free DMARC Report Analyzer turns them into a readable table in your browser, and our guide on how to read DMARC reports explains what to look for.

The "I'm in your account" email sent from your own address

A common scam arrives from your own address and claims the sender has hacked you. The From line proves nothing: it's spoofed. Check the headers, and read our guide to sextortion scam emails before you do anything else. Don't pay.

What should you do if your account was hacked?

Treat it as urgent. Every minute the attacker is inside, they can read mail, phish your contacts and set up fraud.

1. Change the password from a trusted device, and change it on any other account that used the same one. The NCSC advises changing the password "for any account that has been hacked."
2. Sign out all other sessions. In Microsoft 365, an admin should revoke sessions. Microsoft recommends disabling the account during the investigation where possible.
3. Turn on MFA, and remove any MFA methods or devices you didn't add.
4. Remove malicious rules and forwarding, including hidden inbox rules, which Microsoft says to check in Exchange Online PowerShell.
5. Delete app passwords. Microsoft notes that app passwords aren't revoked automatically when you reset the password.
6. Check app consents and admin roles for anything the attacker added.
7. Warn your contacts through a separate channel. The NCSC suggests asking them to treat recent messages from your account with suspicion.
8. Check whether you're blocked from sending. Microsoft says an account used to send spam or a high volume of email is likely to be blocked; see Microsoft 365 user blocked from sending.

If money was involved, call your bank first. Our guide to business email compromise covers what to do next.

What if you can't tell which it is?

Treat it as a hack until you've ruled that out. Securing an account that turns out to be fine costs you an hour. Missing a real compromise can cost far more.

1. Reset the password and sign out all sessions.
2. Check sign-ins, rules and forwarding.
3. Get the headers of one suspicious message and check authentication.
4. Check your DMARC policy either way. Spoofing and account takeover often happen to the same organizations.

How do you stop it happening again?

• Enforce DMARC at p=quarantine or p=reject so receivers reject exact-domain spoofs.
• Use MFA everywhere, with phishing-resistant methods for admins and finance staff.
• Block automatic external forwarding unless there's a business reason for it.
• Filter inbound mail so phishing that steals passwords reaches fewer people. Our email security checklist covers the basics.
• Watch for drift in your MX, SPF and DMARC records, so a change doesn't quietly undo your protection.

Next steps

1. Check Sent Items and your sign-in activity now.
2. Ask one recipient for a copy of the message as an attachment, and read its headers in the Email Header Analyzer.
3. Run the free Email Health Check to see your SPF, DKIM and DMARC status in one place.
4. If you want inbound filtering with spoofing protection and drift alerts for your domain's MX, SPF and DMARC, see how iBlockSpam works.

Related: what email spoofing is. If you use iBlockSpam, DMARC monitoring shows which servers send mail as your domain, so spoofing stands out from your own senders.

Browse our other phishing and threat guides.