Responding when email messages impersonate you

01

Obtain the message without spreading the risk

Ask the recipient to preserve the original message for the appropriate technical review. Record when it arrived and what it requested. Avoid encouraging recipients to click its links or open attachments to help investigate.

For example, a message with your name but an unfamiliar address may be an impersonation attempt. A message also appearing in your sent folder raises a different question. Neither observation should be turned into a public accusation about the suspected sender without evidence.

02

Review account security through official controls

The FTC identifies unexpected sign-in notices and messages you did not send as possible signs of compromise and recommends following the provider's recovery guidance. Use the provider's official security page, and involve your organization's technical team for a work account.

Do not change unfamiliar domain settings based on a random message. Technical configuration should be handled by someone authorized to maintain the organization's email service.

• Review recent access and recovery contact details.
• Check unfamiliar forwarding rules or connected access.
• Keep verification codes and recovery material private.
• Preserve relevant evidence for the technical team.
• Have domain administrators assess email authentication where applicable.

03

Warn affected contacts with verified facts

Use a known channel to explain that the specific message was not authorized and provide a safe way to verify future requests. Avoid repeating the suspicious link. If a payment request was involved, ask recipients to contact their payment provider through a trusted route if they acted on it.

Record which messages and accounts were affected, what the review confirmed and any follow-up needed. Public reassurance should match the evidence; account recovery does not automatically recall messages already delivered.

Continue with your next step

Related guides on this topic