Your customers are answering messages you never wrote.

Start with the list of who received it

Your goal on this page isn’t to decide how it happened. It’s to build the list of people who got something from you that you didn’t write, because that list decides who you call. Start with what you can see yourself.

1. Write down the customer who told you: their name, the message subject, and the date and time they received it.
2. Check Sent Items and Deleted Items for the same subject. Microsoft lists suspicious messages in these two folders (its example is “I’m stuck in London, send money”) among the signs of a compromised mailbox.
3. Check your signature. Microsoft also lists a changed signature, such as a fake banking one, and changes to your entry in the company address book (name, phone number, postal code) as signs.
4. Ask each customer you reach whether others at their company got the same message, and whether anyone replied.

Ask for a message trace

Microsoft 365 keeps a message trace that records, for each message the service handled, the date, sender, recipient, subject, and delivery status. It doesn’t depend on what is left in your folders. Whoever administers your Microsoft 365 can run it. At admin.exchange.microsoft.com, it’s under Mail flow, then Message trace.

Give them these settings to use:

• Sender: your address. Direction: Outbound.
• Time range: the default is two days. It can go up to 90 days, but a search of 10 days or less returns results immediately, and anything longer is prepared as a downloadable report that can take hours.
• What to read: every recipient on every message you don’t recognize. The report lists one recipient per line.
• IP address: the extended reports include the IP address of the device or server that submitted each message, and Microsoft keeps that detail for only 10 days. If the first message was longer ago, ask for that report sooner rather than later.

A quiet outbound record doesn’t mean nothing went out

When an account sends a high volume of mail, Microsoft 365 can block the mailbox from sending and list it on a Restricted entities page. If your own mail has stopped going out, or bounced, that may be the reason, and an administrator has to remove the block. The trace will show the messages that went before the block. It can’t show messages that were never sent.

What to tell the people on the list

Contact them by phone or a new message you start yourself, not by replying in the thread that carries the fake message. The Federal Trade Commission’s guidance for a business whose name was used is to notify customers quickly and to send the notice without hyperlinks, so it doesn’t look like another phishing message. It also suggests reminding them of your policy, for example that you will never ask for a bank account or card number by email.

A short version you can adjust: “You may have received an email from me on [date] about [subject]. I didn’t write it. Please don’t open any attachment or follow any link in it, and please call me before you act on anything it asked for.”

Put the customers who were asked for money, a payment change, or a login at the top of your call list.

What these records can and can’t tell you

A trace shows what the service handled: who received which message, and when. It doesn’t show what the recipient read, clicked, or paid, and it doesn’t show how the sender got in. A message with your address on it but sent from elsewhere may not appear in your outbound trace at all, which is a separate question from this list. The page on messages that appear to come from yourself covers that.

When we look at this with you, we read the trace, the mailbox rules, the sign-in history, and the sign-in methods. You get a dated list of what we saw in each, and what we couldn’t see.

The list of recipients is what lets you reach each customer before they act on a message you never wrote.

Related

• Emails That Appear to Come From Your Own Address
• A Forwarding Rule in Your Email You Didn’t Create
• Who to Tell After a Security Incident, and in What Order
• Keeping Evidence Before You Clean Up a Computer

Sources

• Microsoft Learn: Respond to a compromised email account in Microsoft 365
• Microsoft Learn: Message trace in the new Exchange admin center
• Federal Trade Commission: Cybersecurity for small business, business email imposters