Someone is sending emails as my business. What do I do?

A client forwards you an email. It has your name on it, maybe your logo, and it asks them to pay an invoice to a new bank account. You didn’t send it. Your first question is how someone did. The answer decides what you do next, because there are four different ways this happens, and only one of them is fixed by DMARC.

Which of the four is it?

Look at the “from” address on the fake email, not just the name shown.

What you see	What it is	Does DMARC stop it?
Your exact address or domain, but nothing in your Sent Items	Spoofing. Someone forged your domain on an email sent from their own system.	Yes, at quarantine or reject
A domain that looks like yours: youragency-uk.com instead of youragency.co.uk, or rn in place of m	Lookalike domain. Someone registered a near-copy.	No
Your name, but a Gmail, Outlook or other unrelated address	Display-name spoofing. Only the name shown is faked.	No
Your exact address, and the email is in your Sent Items	Compromised mailbox. Someone has logged in to a real account.	No, and this is the most urgent

If you can’t tell which it is, your IT provider can confirm it from the email’s headers in a few minutes. The headers show whether the message passed the authentication checks and which server really sent it.

What should we do in the first hour?

Whatever the cause, these steps come first.

1. Warn the people who received it. Call them, or email them from a fresh message rather than replying to the fake. Tell them not to pay, click or reply.
2. Pause any change to bank details. Tell your finance team to confirm every request by phone, using a number you already hold, not one from the email.
3. If money has been sent, call your bank now. The sooner the bank knows, the better the chance of recovering it.
4. Keep the evidence. Ask the recipient to forward the fake as an attachment, which keeps its headers. Don’t delete it.
5. Call your IT provider. Tell them which of the four you think it is.

What if our mailbox has been compromised?

Treat it as urgent. Someone who is inside a real account can read past emails, send convincing replies in existing threads, and watch for invoices to intercept. Your IT provider should:

• Reset the password and sign the account out of every device and session.
• Check the sign-in methods for MFA. Attackers often add their own phone or app so they can get back in.
• Remove any inbox rules the attacker created. Rules that forward mail elsewhere, or quietly delete replies, are common.
• Look at what was accessed, and when.

If the mailbox held personal data about clients or staff, this may be a personal data breach. Under UK GDPR, a breach that poses a risk to people must be reported to the ICO within 72 hours of you becoming aware of it.

What if someone is spoofing our domain?

This is the one DMARC is built for. Spoofing works because nothing tells email providers that the message is fake. A DMARC record set to quarantine or reject does exactly that: messages that fail are sent to spam or refused.

It is also the gap most firms have. In our October 2026 check of 896 UK agencies, PR firms and architecture practices, 54.1% had nothing stopping it. They either had no DMARC record or one set to p=none, which reports fakes but still delivers them.

The checker at the top of this page shows your current setting in about a minute.

What if it’s a lookalike domain or a fake name?

DMARC protects your domain, not domains that resemble it. For these two:

• Lookalike domains: ask your IT provider or domain registrar to report the domain for takedown. Consider registering the most obvious variations of your own domain yourself.
• Display-name spoofing: most email systems can flag messages from outside your organisation. A clear “external sender” warning makes a fake from “Accounts Team” at a Gmail address much easier to spot.
• For both: a rule that every change to bank details is confirmed by phone defeats almost every version of this fraud, whatever the email looks like. Staff awareness training helps people spot the rest.

Who should we report it to?

• Fraud or attempted fraud: Report Fraud, which replaced Action Fraud in December 2025. Report online at reportfraud.police.uk or call 0300 123 2040. It covers England, Wales and Northern Ireland. In Scotland, call Police Scotland on 101.
• The fake email itself: forward it to the NCSC’s Suspicious Email Reporting Service at report@phishing.gov.uk.
• A compromised mailbox holding personal data: the ICO, within 72 hours, if the breach poses a risk to the people involved.
• Your clients and suppliers: a short, factual note saying what happened and how to verify requests from you. It protects them and shows you’re on top of it.

What this means for your agency

Most of the damage from these emails happens in the gap between the fake arriving and anyone realising it’s fake. Two things close that gap before you ever need this page. First, a DMARC policy at quarantine or reject, so fakes using your exact domain never reach an inbox. Second, a phone-check rule for any change to bank details, which stops the fraud even when the email looks perfect.

Check your domain with the checker at the top of this page. If this is happening to you right now, contact us and we’ll help you work out which of the four it is.

Frequently asked questions

Can someone send email from my address without my password? Yes. Without a DMARC policy at quarantine or reject, anyone can put your domain in the “from” line of an email sent from their own system.

How do I know if my email account has been hacked? The fake appears in your Sent Items, people reply to emails you didn’t send, or you find inbox rules you didn’t create. Any one of these means you should call your IT provider straight away.

Will DMARC stop all fake emails? No. It stops fakes that use your exact domain. It doesn’t stop lookalike domains, fake display names, or emails sent from a hacked mailbox.

Is our business liable if a client pays a fake invoice? That depends on the circumstances and is a question for a solicitor. Acting quickly, warning clients and showing reasonable protections were in place all help.

Sources

• • Cubit Technology: DMARC adoption in UK agencies, October 2026
  • City of London Police: Report Fraud service goes live
  • NCSC Suspicious Email Reporting Service: report@phishing.gov.uk
  • ICO: personal data breach reporting under UK GDPR