# Someone is sending emails pretending to be my company: what to do

A customer forwards an email "from you" asking them to pay an invoice into a
new bank account. You never sent it. Business email compromise like this is
the costliest fraud aimed at businesses: the FBI's Internet Crime Complaint
Center recorded about $3 billion in reported losses in 2025.

There are two ways it is done, and the fix is different for each.

## 1. Find out which kind it is

Look closely at the sender's address, character by character.

- **It is exactly your domain** (`billing@example.com`). Someone is spoofing
  it. That only works when your domain's DMARC policy doesn't tell receivers
  to reject unauthenticated email.
- **It is almost your domain** (`billing@examp1e.com`, `example-invoices.com`,
  `exarnple.com`). Someone registered a lookalike domain. DMARC on your domain
  can't stop this, because it isn't your domain.

## 2. In the first hour

1. **Warn the customer** by phone, not by replying to the thread, and tell
   them not to pay.
2. **If money was sent,** the customer should call their bank immediately and
   ask for a recall. Speed matters more than anything else here.
3. **Keep the evidence:** the full email with headers, and the lookalike
   domain name.
4. **Report the lookalike** to the registrar's abuse contact (published in
   its registration data) and to the hosting provider. Include the email as
   evidence.

## 3. Stop it happening again

- **Publish DMARC at `p=reject`** (via `p=quarantine` first) so nobody can
  send as your exact domain.
- **Watch for lookalikes.** New ones get registered all the time, and they
  often sit parked for weeks before a mail server is added right before an
  attack. Some use letters from other alphabets: see
  [punycode and xn-- domains](/guides/punycode-homograph-domains).
- **Tell customers how you handle bank details:** you will never change them
  by email alone, and they should call a known number to confirm.
- **Watch your suppliers' domains too.** The same trick is used against you,
  with fake emails "from" a supplier.

Next steps in detail: [DMARC p=none to p=reject](/guides/dmarc-none-to-reject) and [How to report a lookalike domain and get it taken down](/guides/report-lookalike-domain-takedown).

## Check your domain

The free scan checks your DMARC policy and searches hundreds of lookalikes of
your domain, showing which are registered and which can already send email.

---
Source: https://nameward.app/guides/someone-is-pretending-to-be-my-company (updated 2026-10-29)