A customer got an email from you. You never sent it.

You pay for email, it has worked for years, and mostly that’s handled. Nobody has checked yet whether this message came from inside your account or was only made to look that way. The person who received it can’t tell the difference, and the two need different responses.

Two ways a message can look like it came from you

A forged sender. Someone put your name, your address, or a domain one letter off from yours on a message sent from somewhere else. Your account was never opened. You will usually find no copy of it in Sent Items.

Someone inside your account. Someone signed in as you, or set up a rule that works in the background. You may find a copy in Sent Items or Deleted Items, a rule that hides replies, or sign-ins from places you’ve never been.

Checks you can make in a few minutes

1. Look for the message in Sent Items and Deleted Items.
2. Look at your inbox rules for any you didn’t create, especially one that forwards mail, deletes it, or moves it to RSS, Notes, or Junk.
3. Look at forwarding for an address you don’t recognize.
4. Look at sign-in activity for a place, device, or time you don’t recognize, and for sign-in approval prompts you didn’t start.
5. Look at the sender line of the message your customer received: the full address, and whether a reply would go to a different address.

Menu names differ by mail program and version. In Outlook on the web, rules are under Settings, Mail, Rules, and forwarding is under Settings, Mail, Forwarding. Check both, because they are separate. Sign-in history is on your account’s security page.

A rule or a sign-in you can’t explain points to the account. A clean Sent folder and no rules point to a forged sender, but they don’t prove it, because a person who got in can delete what they sent.

What to do first

• Ask your customer to forward the message to you as an attachment. That keeps the technical headers.
• Don’t delete anything from your mailbox yet.
• Tell the people who received it, by phone, not by replying.
• If anyone was asked to pay an invoice or change payment details, call that person on a number you already had. If money moved, call your bank’s fraud department the same day.
• Change your password from a computer you trust, and turn on sign-in approval.

What we check with you

Mailbox rules, forwarding, sign-in history, app permissions, and sign-in methods. The message headers. The domain’s mail records (SPF, DKIM, and DMARC), which show who is allowed to send as you. A computer scan can’t see inside a mailbox, so we start with the mailbox.

We tell you what we found and what we didn’t, with dates. A clean result covers what we examined, on the date we examined it.

If it’s a forged sender, you fix your mail records. If it’s your account, you close the door someone is using. The first step is knowing which.

Send this page to the owner

Written by Craig Peterson, 35+ years successfully running IT and security for businesses. Last reviewed October 27, 2026.