Hacked, Spoofed or Lookalike Email? How to Tell the Difference

An email that appears to come from you does not always mean someone signed in to your mailbox. The message may have been sent from a compromised account, forged to display your address, or sent from a domain that looks almost like yours. These situations can look similar to recipients, but they require different checks.

Signs your mailbox may have been accessed

Look for messages in Sent that you did not send, sign-in alerts you do not recognise, changed recovery details, missing mail, or new forwarding rules and connected apps. Several signs together are a reason to treat the mailbox as potentially compromised, but one clue alone does not prove how the message was sent.

Secure the mailbox from a device you trust. Change its password, review recovery methods and active sessions, remove unknown apps and rules, and contact the mail administrator if it is a business account. If the mailbox is hosted on your domain, ask the provider to review authentication and mail logs.

What spoofing means

Email spoofing is when a message is made to look as if it came from a trusted sender. The visible sender information can be misleading. A message using your name or address does not, by itself, show that the sender had access to your account.

A recipient or mail administrator can inspect the original message headers and authentication results for more clues. SPF, DKIM and DMARC help receiving systems evaluate whether a message is authorised to use a domain, but these checks are not a simple account-compromise test. A result may need to be interpreted alongside the sending service and mail configuration.

How a lookalike domain differs

A scammer may register an address or domain that resembles yours, for example by adding a letter, changing a character or using a different domain ending. Read the full address after the @ symbol carefully. Do not rely on the sender’s display name or on an email being part of an existing conversation.

If a supplier or customer reports a suspicious payment request, verify it using a phone number or contact method you already trust. Do not reply to the suspicious message or use the contact details it provides.

What to do while you investigate

Preserve the original message and note when it arrived, who received it and what it asked them to do. Avoid posting full headers publicly because they can contain personal or internal technical information. For a business mailbox, ask the administrator to inspect message trace, sign-in records and domain authentication settings.

If money or bank details were sent, contact the bank immediately. Warn affected contacts through a separate channel and tell them not to follow links, open attachments or act on payment changes until verified.

Official guidance

Australian Cyber Security Centre: learn about account compromise — https://www.cyber.gov.au/guidance/learn-about-account-compromise

Australian Cyber Security Centre: recover from business email compromise — https://www.cyber.gov.au/guidance/recover-from-business-email-compromise

CISA: phishing guidance — https://www.cisa.gov/secure-our-world/recognize-and-report-phishing