Scammers can put your address in the From line without ever touching your account. Here’s how to confirm what happened, warn your contacts and report it.
TL;DR
- Spoofing means a scammer faked your address in the From line; a hacked account means someone actually got inside yours.
- Check your sent folder, sign-in activity, mailbox rules and forwarding settings to tell the two apart.
- Report fake messages to the FTC at ReportFraud.ftc.gov, forward them to the Anti-Phishing Working Group, and file with IC3 if money is involved.
- Changing your password will not stop spoofing, because the sender never used your account, though it is still worth doing.
- If you send from your own domain, email authentication helps receiving servers spot and block mail faked as yours.
An email arrives from your own address, or a friend forwards one asking why you sent a strange link. You never sent it. In most cases this is spoofing, which means a scammer typed your address into the From line of a message and sent it from somewhere else entirely. It feels personal, but it does not mean anyone broke into your account. The FTC reports that email was the top method scammers used to contact people in 2024, so spoofed addresses are common enough that this can happen to anyone. This guide walks you through confirming what actually happened, warning the right people, reporting it and making your address harder to fake.
Spoofing or Hacking: Which One Happened to You?
The two problems look similar from the outside and call for different fixes. Spoofing happens entirely outside your account. The sender never saw your messages, never read your contacts and never entered your password. They simply forged the return address, the same way a criminal can fake the name and number on your caller ID, as the FTC explains.
Hacking is different. A hacked account means someone gained real access, often by guessing a simple password, tricking you into entering it on a fake sign-in page, reusing a password from another breached site, or capturing it with malware. The risks are much larger, because the intruder can read your mail, contact people you know and look for financial details.
Use this comparison to sort out which situation you are facing:
| Question | Spoofing | Hacked account |
|---|---|---|
| Who sent the message? | An outsider faking your address | Someone with access to your account |
| Is it in your sent folder? | No | Often yes, or deleted from it |
| Can they read your mail? | No | Yes |
| Main fix | Report it and warn recipients | Secure the account immediately |
If the evidence points to a real break-in, stop reading and follow our guide to recovering a hacked email account first. Everything below assumes your account is still yours.
First Steps: Check Your Sent Folder and Sign-In Activity
Before you tell anyone anything, gather facts. Work through this list in order.
- Open your sent folder. Spoofed messages never pass through your account, so nothing will be there. A message you did send is a sign of compromise.
- Review sign-in activity. Most providers show recent logins with time, device and location in the security settings. Look for sessions you do not recognize.
- Check mailbox rules and forwarding. The FBI’s Internet Crime Complaint Center warns that intruders who compromise accounts often set rules to delete key messages or enable automatic forwarding to an outside address. Delete any rule you did not create.
- Review connected apps. Some scams trick people into approving a malicious application that keeps access to the account. The FBI notes that this access survives a password change and can only be removed by revoking the app’s authorization in your security settings.
- Look at active sessions and devices. Sign out everywhere if anything looks off.
If all of that comes back clean, you are almost certainly dealing with spoofing. Lock down the basics anyway. Our guide to five ways to secure your email account covers the settings worth checking, including multi-factor authentication, which the FTC recommends because it keeps scammers out even if they learn your password.
What Do You Tell People Who Got the Fake Message?
Recipients may be worried, angry or already fooled. A short, plain message from you goes a long way. Send it by mail, email or social media if you run a business, and follow one rule above all: include no links. If scammers are impersonating you, the FTC advises notifying people without hyperlinks so your own warning does not look like another phishing attempt.
Cover these points in your note:
- Your address was spoofed and the message did not come from you.
- You did not ask anyone for money, gift cards, payment apps or account details, and you never will by email.
- Recipients should not click links or open attachments in the fake message.
- Anyone who replied with personal or financial information should report it at IdentityTheft.gov to get a recovery plan, as the FTC recommends.
If you run a business, remind customers not to share personal information over email or text. You can repeat the warning on your website or social media so people who never got your direct note still see it.
Tip
Keep a short warning message drafted and saved. If spoofing happens again, or hits a colleague, you can send it within minutes instead of writing it under pressure.
How Do You Report a Spoofed Address?
Reporting does two things: it builds a record, and it puts the scam in front of agencies that track these schemes. File reports even if nothing was lost.
- Report it to the FTC at ReportFraud.ftc.gov. The FTC treats these impersonation scams as fraud worth tracking.
- Forward the fake message to the Anti-Phishing Working Group at reportphishing@apwg.org, which the FTC recommends for phishing reports.
- File with the FBI’s Internet Crime Complaint Center at ic3.gov if the fake message asked for money, invoices or payments. The complaint form asks for details such as the sender’s address, the date, the amount and the payment method. Include the email header and body if you have them, along with any suspicious login details, but never enter sensitive personal information such as a Social Security number or date of birth on the form. IC3 complaints are analyzed and may be referred to law enforcement agencies.
- Tell local law enforcement if a customer or contact lost money to a scheme using your address.
Save copies of the fake message, including the full header, before you delete it. The header shows the servers the message actually traveled through, which is useful evidence.
Will Changing Your Password Stop It?
No. This is the part that frustrates people most. Spoofing never used your password, so changing it cannot stop the forgeries. The scammer can keep sending mail with your name on it until they move on to another target.
Change your password anyway if you have not done it in a while, and turn on multi-factor authentication while you are in there. These steps will not fix spoofing, but they protect you against a common follow-up: the same criminals who spoof an address often send phishing aimed at getting the real credentials. The FTC warns that phishing emails tell a story, such as a fake billing problem, to push you toward clicking a link. Do not click links in unexpected messages, even ones that appear to come from a company you know. If you already clicked one, update your security software and run a scan.
One more caution. The FBI has warned about consent phishing, where a victim approves a malicious application and the attacker keeps access to the account even after the password changes. If you approved any unusual app permission request around the time this started, revoke it in your account’s app settings.
How Do You Make Your Own Domain Harder to Spoof?
Anyone using a free email address mostly has to wait out a spoofing campaign. If you send mail from your own domain, you can do more. The FTC advises businesses to use email authentication, so that receiving servers can confirm a message really came from your company’s server and block the ones that did not.
Authentication works through DNS records on your domain. The three you will hear about are SPF, DKIM and DMARC. In plain terms, they let you publish a list of the servers allowed to send as your domain, attach a verifiable signature to real mail, and tell receiving servers what to do with anything that fails the check. Most email providers and domain hosts have instructions for setting these records up, and many offer them as part of standard business email service.
Authentication will not stop every forgery, but it cuts the amount of fake mail that reaches inboxes, protects your customers and helps your legitimate mail avoid spam folders. If you have not set up your own domain yet, read why your business should use its own email domain. And if a spoofing attempt turns into a targeted scheme to reroute payments, that is business email compromise, which our guide to spotting and stopping BEC covers in depth.
How Do You Spot It Faster Next Time?
Once your address has been spoofed, you and the people around you become better judges of the real thing. Build these habits into how you send and read mail.
- Read the full address, not just the display name. The FBI warns that scammers use usernames that look official but come from unrelated domains, sometimes with extra characters or misspellings.
- Do not trust logos, letterhead or polished formatting. The FBI notes these are easy to copy and prove nothing.
- Watch for pressure. Urgency is a standard scam tactic. A message that demands immediate payment or threatens consequences deserves extra suspicion, not less.
- Verify through a channel you already trust. If a message seems to be from someone you know, call them or write to the address you already have, not the one in the suspicious email.
- Mark anything that slips through as spam or junk, which the FTC recommends, because filters learn from what you report.
Knowing the warning signs yourself is the strongest defense. Our guide to spotting a phishing email before you click walks through the tells in detail.
Spoofing is unsettling, but it is survivable and usually short-lived. Confirm your account is secure, warn your contacts in a link-free message, file your reports, and set up authentication if you send from your own domain. Then open your email security settings today and turn on multi-factor authentication, because that single step closes the door a spoofing scammer hopes to walk through next.
Quick answers
Q: Does spoofing mean my email account was hacked?
A: Not necessarily. Spoofing only means a scammer faked your address in the From line of a message they sent. Check your sent folder and sign-in activity to confirm nobody actually accessed your account.
Q: Who do I report a spoofed email address to?
A: Report it to the FTC at ReportFraud.ftc.gov and forward the fake message to the Anti-Phishing Working Group at reportphishing@apwg.org. If money was requested or lost, file a complaint with the FBI’s Internet Crime Complaint Center at ic3.gov.
Q: Will changing my password stop the spoofed emails?
A: No, because the scammer never signed in to your account to send them. Changing your password and turning on multi-factor authentication is still smart, since it protects you if the same scammer later tries to get in.
Q: Should I warn people who received the fake message?
A: Yes, and do it in a plain message with no links, so your warning does not itself look like a phishing attempt. Remind recipients never to send money or personal information by email in response to unexpected requests.
Email services change their settings and menus often. This guide is general information, not legal or professional security advice; check your provider’s help pages and official sources such as FTC.gov and CISA.gov.
