Getting spam is annoying. Finding out that spam is going out with your email address on it — friends asking why you sent them a strange link, or bounce-back messages for emails you never wrote — is worse. When that happens, one of two things is going on:
- Spoofing — someone is forging your address on their messages. They have no access to your account; they’ve simply typed your address into the “From” line.
- Hijacking — someone has actually broken into your email account. They can read your messages, see your contacts and send email as you.
The two need very different responses, so the first step is working out which one you’re dealing with.
Spoofing or hijacking? How to tell
- Check your Sent folder. If the spam appears there, your account has been hijacked. (A careful attacker may delete it, so an empty Sent folder isn’t proof you’re safe.)
- Check your account’s recent sign-in activity. Most providers — Gmail, Outlook.com, Yahoo and others — show recent sign-ins in the account’s security settings. Sign-ins from places or devices you don’t recognize mean someone else has been in your account.
- Look for settings you didn’t make, such as forwarding rules, filters that delete or move messages, or a changed signature or auto-reply.
- Bounce-back messages for emails you never sent, with nothing in your Sent folder and nothing unusual in your sign-in activity, usually point to spoofing.
If you’re not sure, treat it as a hijacking and secure your account. It does no harm and only takes a few minutes.
If your account was hijacked
- Use a computer or phone you know is clean. If your password was stolen by malware, changing it on an infected computer may just hand over the new one.
- Change your password right away. If you can’t sign in, use the provider’s “Forgot password?” or account-recovery option. If that fails, contact the provider’s support team and explain that your account has been compromised.
- Sign out everywhere else. Most providers have an option in their security settings to sign out of all other sessions and devices.
- Check your recovery details. Make sure the recovery email address and phone number on the account are still yours — attackers often change them so they can get back in.
- Remove anything you didn’t set up: forwarding rules, filters, auto-replies and connected apps.
- Turn on two-step verification so a stolen password alone isn’t enough to get in.
- Change any other accounts that used the same password — attackers try stolen passwords everywhere. Also change accounts whose password-reset emails go to this mailbox, starting with banking.
- Scan your computer with up-to-date antivirus, in case malware stole the password in the first place.
- Let your contacts know that messages sent from your address recently weren’t from you, and that they shouldn’t open any links or attachments in them.
Most hijackings start with a phishing email or a reused password from another website’s data breach. Our article Scams and Scammers – Email explains how to spot phishing.
If your address is being spoofed
If your account is secure, there’s little you need to do. Forging the “From” line doesn’t require access to your account, and spoofers usually move on quickly. Major email providers now use sender-verification standards that let receiving mail servers check whether a message really came from where it claims, so a lot of forged mail is caught as spam before it reaches anyone. If friends do receive it, let them know it wasn’t from you.
If you own your email domain
If your email address uses your own domain — as many businesses do, with addresses like name@yourbusiness.com — you can do more. Three settings on your domain, called SPF, DKIM and DMARC, tell other mail servers which servers are allowed to send your email and what to do with messages that fail the check. Set up correctly, they make it much harder for anyone to send convincing email in your name, and they improve the chances that your genuine email reaches inboxes. Google and Yahoo now require them from businesses that send large amounts of email.
Keep your email account secure
- Use a long password. Length matters more than complexity: aim for at least 15 characters. A passphrase of several random words is long, strong and easier to remember than a short jumble of symbols.
- Use a different password for every account, and let a password manager remember them for you.
- Turn on two-step verification — a code from an authenticator app, a prompt on your phone, or a security key. Many providers now also support passkeys, which let you sign in with your phone or computer’s fingerprint, face or PIN instead of a password.
- Never send passwords by email, and never enter your email password on a page you reached by clicking a link in a message.
Need a hand?
If you think your email has been spoofed or hijacked and you need help getting it back under control, call PSA at (707) 506-6802 or send us a message.