Is a Scammer Using Your Email Address? (Email Spoofing)

A friend calls and asks, “Did you really email me asking for gift cards?” Or a strange message lands in your inbox that seems to come from your own address. It is unsettling, and it raises an urgent question: has a scammer broken into my email, or are they just pretending to be me?

This guide explains the difference, how to check, and exactly what to do in either case.

Two different problems: spoofed vs. hacked

Spoofed means a scammer is making messages look like they come from you, without being inside your account. The FBI’s Internet Crime Complaint Center defines phishing and spoofing together as unsolicited email, texts and calls that pretend to come from a legitimate source to get personal, financial or login information. The same trick is used with phone numbers: the FTC warns that some scammers even send texts that appear to come from your own phone number.

Hacked (or compromised) means someone actually got into your account — usually with a stolen or guessed password — and can read your mail and send messages as you.

It can also be a third thing: a virus on someone’s computer. CISA, the federal cybersecurity agency, notes that a familiar “From” address does not guarantee safety, because some viruses spread by searching an infected computer for email addresses and sending themselves to those addresses, disguised as email from the computer’s owner.

EXAMPLE — SCAM

Today 9:02 AM●●● ▮

From: Your Name <you@mail.example.com>

Subject: Quick favor — are you around?

Hi, I’m in a meeting and can’t talk on the phone. I need to get a few gift cards for my niece’s birthday today but I’m stuck. Could you pick up four $100 cards and send me photos of the backs? I’ll pay you back tonight. Thanks so much.

Step 1: Check whether your account was actually hacked

The FTC lists these signs that an email or social media account has been hacked:

• You can’t log in to your account.
• You get a notification about a change to your username or password that you didn’t make.
• You get an alert that someone logged in from a device you don’t recognize.
• Friends or family say they’re getting emails or messages you didn’t send.

Then look inside your account:

• Sent folder: are there messages you didn’t write?
• Deleted folder: the FTC notes an intruder may read and then delete messages.
• Forwarding rules: delete any rule you didn’t set up — it could be sending copies of your mail to someone else.
• Recovery details: make sure the backup email address and phone number are yours.

If you find any of these, treat your account as hacked and go to Step 2 right away. If you find none, your address may be spoofed — but Step 2 is still a good idea.

Step 2: Lock down your account

The FTC recommends these steps:

1. Scan your device. Make sure your computer’s security software is up to date, then run a scan. Delete anything it flags and restart your computer.
2. Change your password to a strong one that is hard to guess. If you used the same password anywhere else, change it there too.
3. Sign out of all devices, so anyone else who is logged in gets kicked out.
4. Turn on two-factor authentication, so a password alone isn’t enough to get in.
5. Check your recovery email and phone number and fix them if needed.

If you can’t log in at all, use your email provider’s official account-recovery process. Type the provider’s address into your browser yourself rather than following a link in an email.

Step 3: Warn your contacts

Send a quick email, text or post to your contacts. The FTC suggests telling them about the problem and asking them not to click links in emails from you and to ignore any pleas for help or money. That message alone can stop a friend from buying gift cards for a scammer.

The “I hacked you” blackmail email

A related scam arrives in your inbox claiming the sender hacked your computer and recorded you, and threatening to share the video unless you pay in Bitcoin. Sometimes it includes one of your real old — or recent — passwords, which the FTC says probably came from a data breach.

The FTC’s advice is short: stop, don’t pay anything, delete the message — it’s a scam. If the email includes one of your passwords, change it, and consider whether other passwords need changing too.

If you clicked something or shared information

• Entered your email password on a strange page: change it immediately and follow Step 2.
• Shared financial information or your Social Security number: go to IdentityTheft.gov and contact your bank.
• Lost money: follow our first-hour checklist.

Reporting it

Report scam emails to the FTC at ReportFraud.ftc.gov, and forward phishing emails to reportphishing@apwg.org. If someone took over your account, stole money or used your identity, also file a complaint with the FBI at IC3.gov. See how to report a phishing email for step-by-step instructions.

To learn what phishing emails look like — including ones that pretend to come from people you know — see phishing emails: real examples and 7 red flags.