Someone is sending emails pretending to be my company: what to do

A customer forwards an email "from you" asking them to pay an invoice into a new bank account. You never sent it. Business email compromise like this is the costliest fraud aimed at businesses: the FBI's Internet Crime Complaint Center recorded about $3 billion in reported losses in 2025.

There are two ways it is done, and the fix is different for each.

1. Find out which kind it is

Look closely at the sender's address, character by character.

• It is exactly your domain ([email protected]). Someone is spoofing it. That only works when your domain's DMARC policy doesn't tell receivers to reject unauthenticated email.
• It is almost your domain ([email protected], example-invoices.com, exarnple.com). Someone registered a lookalike domain. DMARC on your domain can't stop this, because it isn't your domain.

2. In the first hour

1. Warn the customer by phone, not by replying to the thread, and tell them not to pay.
2. If money was sent, the customer should call their bank immediately and ask for a recall. Speed matters more than anything else here.
3. Keep the evidence: the full email with headers, and the lookalike domain name.
4. Report the lookalike to the registrar's abuse contact (published in its registration data) and to the hosting provider. Include the email as evidence.

3. Stop it happening again

• Publish DMARC at p=reject (via p=quarantine first) so nobody can send as your exact domain.
• Watch for lookalikes. New ones get registered all the time, and they often sit parked for weeks before a mail server is added right before an attack. Some use letters from other alphabets: see punycode and xn-- domains.
• Tell customers how you handle bank details: you will never change them by email alone, and they should call a known number to confirm.
• Watch your suppliers' domains too. The same trick is used against you, with fake emails "from" a supplier.

Next steps in detail: DMARC p=none to p=reject and How to report a lookalike domain and get it taken down.

Check your domain

The free scan checks your DMARC policy and searches hundreds of lookalikes of your domain, showing which are registered and which can already send email.