Someone is sending fake emails in my business's name. What do I do?
Scammers can put your business name on an email, and sometimes your actual email address too. Today, warn your customers and report it. For the long run, your domain has a protection setting that can tell Gmail, Outlook and others to junk or block email that pretends to come from your address. It can’t stop look-alike addresses (say, smith-bookkeeping-billing.com), so your customers still need to stay alert.
Check your own email first. Free, about 90 seconds. You get a grade and a plain-English list of what's working and what isn't.
Why this happens
Fake emails in your name come in three kinds, and each one has a different fix.
- Your real address, forged. The email claims to come from you@yourbusiness.com but was sent by someone else. Your domain’s protection setting is built to stop exactly this.
- A look-alike address. One letter off, or an extra word in the name. Microsoft points out these can pass every check, because the scammer really does own that look-alike domain.
- Your actual mailbox, hacked. The email really did come from your account. That’s a password problem, and it’s the first thing to rule out.
What to do today
- Check your Sent folder for emails you didn’t write. If you find any, change your password now and turn on two-step sign-in. Our guide to a blocked or hacked Microsoft account has the steps.
- Warn your customers. Email them, call your biggest ones, or post on your social pages. The FTC suggests sending your warning without any links in it, so nobody mistakes it for another scam.
- Tell them how to check. For example: “We will never change our bank details by email. If you get an invoice that looks odd, call us at our usual number.”
- Report it. Forward the fake email to reportphishing@apwg.org, and report it to the FBI at IC3.gov and to the FTC at FTC.gov/Complaint.
Stop it happening again
- Run the free check below. It shows whether your domain has its protection setting.
- Approve every real tool first. Your mailbox, your invoicing, your newsletter, your website. If you skip this, the next step blocks your own email too.
- Turn protection up in stages. It starts in a watch-only mode. Then it can send fakes to junk, and finally block them outright. Each step needs a week or two of reports showing your real email passing.
SenderFix Monitor walks you through those stages one reviewed step at a time, and emails you if someone we don’t recognize starts sending as you.
What this guide can’t do for you
It covers the common causes. It can’t tell you which of your tools is the one that’s failing, or give you the exact settings for your business and the company that manages your domain. That’s what the Email Fix does. We check every tool that sends email for you and give you steps written for your setup. If we can't find what's wrong with your email settings, you get your $299 back. The guarantee covers your email settings. No settings can fix email sent to people who didn't ask for it, like bought lists or mass emails.
See what's wrong with your email, free
Type in your business's web address (the part after the @ in your email). You'll get a plain-English answer: what's working, what isn't, and what to do next.
Common questions
Can I stop scammers using an address that looks like mine?
Not with your own settings. A look-alike address is a different domain the scammer owns. Warn customers to check the exact address, and report the fakes you see.
Does the protection setting stop fake emails straight away?
Not in its starting watch-only mode, which just reports. It only sends fakes to junk or blocks them once it's turned up, and that's safe only after every tool you use is approved.
How do I know if someone is sending email as me?
Once your protection setting is in place, Gmail, Outlook and others send daily reports listing everything that sent email using your address. SenderFix reads those and flags anyone we don't recognize.
For your IT person or web developer
You can forward this page as it is. Everything below is written so someone who doesn't work with email settings every day can follow it.
Spoofing of the exact domain is handled with DMARC enforcement. Look-alike domains are not, since they publish their own valid records.
1. Rule out a compromised mailbox
Check sign-in logs and inbox rules (Microsoft 365: entra.microsoft.com → Identity → Monitoring & health → Sign-in logs; Google Workspace: admin.google.com → Reporting → Audit and investigation → User log events). Reset the password, enforce MFA and remove unknown forwarding.
2. Get every legitimate sender aligned
Every service sending as the domain needs to pass SPF or DKIM aligned with the From domain. Use the DMARC aggregate reports (SenderFix shows them on the results page) to find any that fail.
3. Step the DMARC policy up
Move from p=none to p=quarantine, then to p=reject, only once reports show legitimate mail passing. Microsoft describes quarantine as accepted but marked (junk or quarantine) and reject as typically discarded. Edit only the p= value in the existing _dmarc TXT record and keep the rua= reporting address.
4. Report
Forward samples to reportphishing@apwg.org; report at IC3.gov and FTC.gov/Complaint.
Related guides
Written by the SenderFix team. Last updated .