Someone is sending emails from my address. Have I been hacked or spoofed?

Check your Sent folder. If the strange emails are in it, someone has got into your account, which is being hacked, and you need to act now. If they're not, someone is most likely faking your address from outside, which is being spoofed. Your account is safe, but your domain needs settings that tell other email services to reject the fakes.

Someone is using my email address. What’s the difference between hacked and spoofed?

They look the same to the person receiving the email, but they’re very different problems.

Hacked means someone has your password, or a way round it, and is signed in to your real account. They can read your email, send from it, and set up hidden rules. This is urgent.
Spoofed means someone is sending emails from their own system and just typing your address into the “From” line. They can’t see your inbox. It’s a bit like someone writing your return address on the back of an envelope.

How can I tell which one it is?

Work through these checks. You can do all of them in ten minutes.

1. Look in your Sent folder. If the emails you didn’t write are there, the account was used to send them, so treat it as hacked. Spoofed emails never appear in your Sent folder, because they weren’t sent from your account.

2. Look at any bounce-backs. Bounce-backs (“Undeliverable” or “Delivery failure”) for emails you never sent usually mean spoofing. The fake email was sent in your name to an address that doesn’t exist, and the rejection came back to you.

3. Check recent sign-ins. Look for sign-ins from places, devices or times that weren’t you.

Google Workspace: in Gmail on a computer, click Details in the bottom right of your inbox. It shows where your account is signed in and the last 10 IP addresses used, with rough locations (Gmail Help). For the whole team, an administrator can check Menu › Reporting › Audit and investigation › User log events in the Google Admin console.
Microsoft 365: go to mysignins.microsoft.com and look at your recent activity. An administrator can see everyone’s sign-ins in the Microsoft Entra admin centre under Entra ID › Monitoring & health › Sign-in logs (Microsoft).

4. Check for rules and forwarding you didn’t set up. Attackers who get in often add a rule that forwards your email to them, or quietly moves certain emails to a folder you never look at.

Gmail: Settings › See all settings, then the Filters and blocked addresses and Forwarding and POP/IMAP tabs.
Outlook: Settings › Mail › Rules, and Settings › Mail › Forwarding.

Anything you don’t recognise is a strong sign the account was hacked.

I think I’ve been hacked. What do I do?

Act now, starting with the password. Our guide My business email has been hacked. What do I do? walks through every step in order, for Google Workspace and Microsoft 365.

I think I’ve been spoofed. How do I stop spoofing emails from my address?

You can’t stop someone typing your address, but you can make sure other email services refuse their fakes. That’s the job of three settings on your domain, called SPF, DKIM and DMARC:

SPF lists the services allowed to send email for your domain.
DKIM signs your real emails so they can be checked.
DMARC tells receivers what to do with an email that fails those checks. Set to p=reject, it tells them to refuse it.

First, see where you stand with the NCSC’s free Email Security Check. Then follow the steps in Why are my emails going to spam or junk?, which sets up all three for Google Workspace and Microsoft 365. Work up to DMARC at p=reject. Until you do, spoofed emails can still get through.

Spoofing can also use an address that just looks like yours, such as yourbusiness-uk.com, or “rn” in place of “m”. DMARC can’t stop those, because the criminals own that domain. Warn your customers what your real address looks like.

Should I tell my customers?

If customers have received the fake emails, yes. Tell them, preferably by phone or in a separate email, that the messages weren’t from you, and not to click links, open attachments or pay anything they ask for. That’s especially important if the fake emails mention invoices or bank details. See My customer paid the wrong bank account. Was my email hacked?.

Do I need to report it?

If your account was hacked, or anyone lost money, use the “Who to tell” list below. Pure spoofing, where nothing was accessed and nobody paid anything, usually doesn’t need reporting. Fixing your DMARC settings is the real answer.