Someone Is Sending Emails Pretending to Be My Company: What to Do Now

If money has already moved, the bank is your first call

Before anything else. If a customer or an employee has already paid a fake invoice, changed bank details on your say-so, or wired funds, stop and make two calls.

Call the bank that sent the money and ask for a recall. Same day matters. Banks can sometimes freeze funds still in transit, and that window is measured in hours, not days.

Then file at ic3.gov, the FBI's Internet Crime Complaint Center. IC3 asks for transaction dates and amounts, the recipient's details, and email headers where you have them, so keep everything. IC3 also states plainly that it does not conduct investigations itself, and that if your matter is time sensitive you should contact local law enforcement directly. Do both.

Nothing further down this page replaces those calls. Authentication fixes the next attack, not the one that already cost you money.

What is actually happening

Email was built without any check on who you claim to be. The From line is typed by the sender, the same way you write a return address on an envelope. Anyone can put your company's name and your company's address there, and by default nothing stops the message being delivered.

The industry word for this is spoofing. You do not need the word. You need the answer to one question.

Are they using your exact domain, or one that just looks like it?

There are three versions of this problem. They look identical to your customers and they have completely different fixes.

• Exact domain. The message really does come from billing@yourcompany.com. Your actual domain, character for character. This one is fixable, and permanently.
• Lookalike domain. The attacker registered something of their own: yourcompany-support.com, yourc0mpany.com, or yourcompany.net when you own the .com. It reads as yours at a glance. Email authentication cannot touch it.
• Display name only. The From line reads Your Company Billing, but the address behind it is a free mailbox at gmail.com or outlook.com. Also not fixable by authentication.

How to read the real sending address

Almost nobody can tell those three apart from what their mail app shows them, because most apps display the sender's name and hide the address. So do not guess. Get one complete copy of a real message, with headers, from someone who received it.

In Gmail on a computer, open the message, click More next to Reply, then Show original. The full header opens in a new window with a Copy to clipboard button. This is not available in the Gmail mobile app, so do it on a desktop.

In new Outlook or Outlook on the web, select More actions at the top of the message, then View, then View message details. In classic Outlook for Windows, open the message in its own window, then File, then Properties, and read the Internet headers box.

In Apple Mail on a Mac, choose View, then Message, then All Headers. Shift-Command-H toggles it.

Now find the line beginning Authentication-Results. Three fields matter.

• spf= followed by smtp.mailfrom= is the envelope sender, the address bounces go back to. It is not what the reader sees.
• dkim= followed by header.d= is the domain that put a cryptographic signature on the message.
• dmarc= followed by header.from= is the visible From domain. This is the field that answers your question.

Exact domain: DMARC at enforcement really does stop this

Three DNS records do the work, and all three are things you publish for your own domain.

SPF lists the servers allowed to send mail as you. DKIM puts a signature on your outgoing mail that receivers can verify. DMARC ties those two to the address the reader actually sees, and tells receiving mail servers what to do when neither one lines up.

DMARC was republished as RFC 9989 in May 2026, replacing the older RFC 7489, and is now an Internet Standards Track document. It has three policy settings: none, quarantine and reject.

At a policy of reject, a message that fails both SPF alignment and DKIM alignment is refused during the SMTP conversation. At the mailbox providers your customers actually use, they never see it. Not in spam, not at all. RFC 9989 still leaves final handling to the receiving server, so it is not an absolute. For exact-domain forgery this is the genuine fix, which is why we lead with it.

One detail worth understanding: DMARC only acts when both SPF alignment and DKIM alignment fail. If either one passes and aligns, the message is delivered whatever your policy says.

The honest part is the timeline. Google's own guidance is to have SPF and DKIM live at least 48 hours first, then run a policy of none for a week while you read the reports daily, then move to quarantine for a small share of mail, then ramp to all of it. The DNS edit is not the work. The work is finding every legitimate service that sends as you, invoicing, helpdesk, marketing, payroll, and getting each one aligned before you switch on enforcement. Expect weeks. Anyone offering to set reject this afternoon is offering to break your own email.

Set the rua tag so mailbox providers send you daily XML summaries of everything using your domain, forgeries included. Point it at a dedicated address, because Google warns it can produce a high volume of mail.

Say the limit out loud. This protects your exact domain. It does nothing at all about a lookalike.

Lookalike domain: a harder fight with worse odds

You cannot authenticate away a domain you do not own. What you can do is report it properly.

Start by finding who sold it. Enter the domain at lookup.icann.org and you get the registrar. Since 5 April 2024, section 3.18 of ICANN's Registrar Accreditation Agreement requires registrars to publish an abuse contact, confirm receipt of abuse reports, investigate, and take prompt mitigation action where there is actionable evidence of DNS abuse. Phishing is named explicitly as DNS abuse.

Actionable evidence is the phrase to write to. A one-line complaint is not actionable. Send the full message source including headers, the exact URL, timestamped screenshots, and a plain statement of what the site or email claims to be.

Report the page itself as well, which is a separate process from the domain.

• Google Safe Browsing, at safebrowsing.google.com/safebrowsing/report_phish/
• Microsoft, at microsoft.com/en-us/wdsi/support/report-unsafe-site-guest

Report it, even when it feels pointless

Three reports are worth the twenty minutes.

• The FTC, at ReportFraud.ftc.gov. Choose an impersonator, then that someone was pretending to be a well-known or trusted business. Since 1 April 2024 the FTC's Impersonation Rule, 16 CFR Part 461, directly prohibits impersonating a business in commerce and lets the Commission seek civil penalties and consumer redress. The FTC shares reports with more than 2,000 law enforcers.
• The FBI, at ic3.gov, and this one is not optional if any money moved.
• The Anti-Phishing Working Group, by forwarding the message to reportphishing@apwg.org. APWG asks you to use Forward as Attachment if your mail client offers it, because it preserves more detail for tracing.

What to tell your customers in the first hour

Post one short notice where your customers already look: your website, and whichever social account they actually use. Keep it to three things. What the fake messages look like. What you will never do. One way to check with you directly.

Here is the trap in the obvious advice. Do not tell people to check the sender's address. On a phone, most mail apps show only the display name, so a customer can follow your instructions exactly, see Your Company Billing, and conclude the fake is real. That advice fails precisely where most email is read.

Tell them what you will never ask for instead. We will never email you new bank details. We will never ask for your password. If you get that, it is not us, and here is the number to call. That still works on a phone.

What none of this fixes

Authentication stops people using your exact domain. That is a narrow promise, and it is a real one.

It does not stop somebody registering a lookalike domain tomorrow. It does not stop a fake social profile. It does not remove anything already published. It does not undo a payment. A verified sender logo, whether that is BIMI in Gmail or Apple's Branded Mail, makes your genuine email more recognisable to people who are paying attention. It does not block the fake.

If your incident turns out to be entirely a lookalike domain and a fake page, we will tell you that email authentication is not your fix, and that your money is better spent on the registrar report and a lawyer. We would rather say that than take a fee for the wrong work.

Working with us

We are Verified Everywhere, part of JWC Apps in San Diego. We ran this entire stack on our own business first, a hockey apparel store called Bench Clearers: DMARC at enforcement, a Verified Mark Certificate through GlobalSign, BIMI live in Gmail, and Meta Verified on a 52,000-follower Instagram account. We work only through official channels. We never take your passwords, government ID documents or card numbers. If we do not believe a case can succeed, we say so and decline rather than take the fee. If you want a second pair of eyes on your headers to work out which of the three problems you actually have, get in touch.