Email Spoofing: How to Tell Whether Your Account Was Used

What happened when mail went out in your name

In email spoofing, the sending software fills in the From line. A stranger can write your address there and send the message from outside Gmail without your password. The person who received it sees the address the stranger wrote, even though the stranger never signed in as you.

The message the other person got only shows your address. It can’t tell you whether anyone got into your account. You can check for signs in your own Google Account using the steps below.

Check whether someone used your account

Check your Google Account and Gmail on a computer for signs someone got in.

1. In your Google Account, open Security & sign-in.

   • Select Review security events and look for activity you didn’t cause.
   • Under Your devices, select Manage all devices. Look for devices you don’t recognize, but first check whether one is an old phone or computer of your own.

2. In Gmail, open See all settings, then Forwarding and POP/IMAP.

   • Look for an address receiving your mail. An unexpected forwarding notice can mean someone else has access to your account.
   • Check whether you set up any forwarding address you find.

3. Open Filters and Blocked Addresses.

   • Open rules you don’t remember creating and see what they do.
   • A filter can archive, delete, or forward incoming mail, so messages could be hidden or sent elsewhere.

4. Under Accounts and Import, find Grant access to your account.

   • A delegate is someone you allow to read and send mail for you. A delegate you didn’t authorize has access to your mailbox.
   • For a work or school account, ask your administrator about a delegate you don’t recognize. They may have added the delegate.

5. Open Sent.

   • Messages you didn’t write are a sign of suspicious account activity.
   • An empty Sent folder doesn’t rule out the other signs.

If you find anything you don’t recognize, treat it as a break-in and secure your account. If you find none of these signs, someone forging your address from outside your account is the likely explanation.

Will changing your password stop the mail?

When the account checks show signs that someone else signed in, change your Google Account password immediately and turn on 2-Step Verification. That extra step helps protect your account if someone steals your password.

If the checks showed no signs of account access, changing the password can’t stop messages a forger creates outside Gmail. The person sending those messages never needed your password, and Gmail can’t stop mail created on that person’s system.

Warn clients and other recipients now

The people who got the forged mail may act on it before you’ve finished checking your account, so warn them now. If a client received an invoice with new bank details, tell them someone forged mail in your name and give them the address you really use. Any request to change payment details needs confirmation by phone or another channel the client already uses with you. They shouldn’t verify the change by replying to the questionable message.

If your client paid a forged invoice, tell them to call their bank as soon as they spot the fraud and ask for a recall or reversal. If they’re in the United States, they should also file a complaint with the FBI’s Internet Crime Complaint Center right away. In March 2024, buyers wired $956,342 to complete a real estate closing after an email that seemed to come from their agents. Two days later, they learned the instructions came from a spoofed email. Their complaint reached the FBI, whose Recovery Asset Team stopped the transfer and returned $955,060.

Other people who received the mail need a short, calm note. Tell them the message was forged and state which address is yours. If they want to check with you, give them a way to reach you that they already trust.

Why bounce notices arrive for mail you never sent

Delivery failures go to the return address written on a message. A forger can put your address there as well as in the From line. When the forged messages sent with your address fail to reach their destinations, the notices come back to you, although you sent none of them.

The notices may appear to come from Mail Delivery Subsystem, with a subject such as Delivery Status Notification (Failure). Bounces for mail you never sent are a known sign that someone spoofed your address. They don’t, by themselves, show that anyone entered your account. Report those notices as spam.

If you did send the original message, the bounce means that particular delivery failed. You can work through a bounce for mail you actually sent to find out what happened to it.

What the people who received the mail saw

What appeared in the recipient’s From line determines which protection could have helped. Ask what address appeared beside your name before assuming every forged message used your exact address.

What the original message can tell you

Ask the person who got the message to get the full header in Gmail. A screenshot isn’t enough. In Gmail on a computer, they can open the message, click More, then Show original, and copy what appears. They don’t need an administrator to do this.

Start with the address the message says it came from in the From line. The message’s return address appears as Return-Path. It can legitimately differ from the From line, so a mismatch is a clue rather than proof that someone forged the message.

The line recording the checks run by the receiving system is Authentication-Results. It can show the results for SPF, DKIM, and DMARC. A DMARC fail against your own domain means the receiving system couldn’t confirm that the message came from that domain. The result applies to the message the recipient received, not every message bearing your address. Legitimate mail can also fail after forwarding or passage through a mailing list, so a fail isn’t proof of forgery. A pass doesn’t make a message safe to trust either.

You can paste the header into the email header analyzer. Google’s Messageheader tool reports delivery delays and where they occurred. It doesn’t decide whether a message was spoofed.

What to ask if you send from your own domain

If you use a domain at work or school, ask your IT administrator about the records below. If you set up your own domain, ask the company that hosts your domain or your email. With a personal gmail.com address, you have nothing to set up.

Ask them whether the list of servers allowed to send for your domain (SPF) covers every service that legitimately sends your mail. A service missing from that list may send mail that fails the check. Then ask them whether your domain’s mail carries a signature that receiving systems can verify through DKIM. They should know which services send on behalf of the domain, including ones outside your usual mailbox.

Finally, ask whether the domain has a rule, DMARC, that tells receivers what the domain owner wants done with mail that fails the checks. It checks whether the SPF or DKIM result matches the domain shown in the From line. Whoever runs the domain sets these records at its domain host, not inside a personal Gmail mailbox. If your address belongs to a work or school account, ask its administrator to handle the setup.

Even when the domain owner asks receivers to reject failing mail, a receiving system may still accept a message that fails DMARC. Gmail is very likely to reject mail it can’t match to these domain records or mark it as spam.