Emails going out that you didn’t send

What can cause it

1. Your address typed in as the sender. The message was sent from somewhere else and never passed through your mailbox. Nothing of yours was broken into.
2. A look-alike address. One letter off from yours, or a different ending, like .co instead of .com. At a glance, people read it as you.
3. Someone else has the password. Passwords leak from other websites and then get tried everywhere.
4. A rule, app or sign-in someone added. A forwarding rule, a filter that hides replies, or a connected app or device that can send as you. Some of these keep working after the password changes.
5. A computer or phone with malware on it, sending mail from the inside.

How to tell which one

Look in your Sent folder. If the messages are there, they went out through your account.

If they are not there, and you are getting replies or “undeliverable” notices for mail you never sent, your address was most likely typed in as the sender.

That is a strong clue, not proof: someone inside an account can delete what they sent. So take the first steps below either way. Start with the first one now.

What to do today, in this order

1. Change the email password, then sign out everywhere. Use a password you use nowhere else. Your email provider’s settings or admin page has a way to end every session at once. If this computer might be the source, make the change from another device you trust. If it is a work account, tell whoever manages your email first.
2. Turn on sign-in codes. With a code from your phone as well as the password, a password alone no longer opens the mailbox.
3. Check the settings someone could have added: forwarding, rules and filters, the recovery email and phone number, and any apps connected to the account. Remove anything you did not set up.
4. Check which devices are signed in. Your email provider’s admin page lists them. Sign out any you do not recognize.
5. Tell the people who got the mail. Send a new message rather than a reply, and call anyone the email asked for money or a password.

If the mail uses your own business domain, whoever manages that domain can publish settings that tell receiving mail systems to turn away messages that did not come from your real email service.

If you can no longer get into the account, your email provider’s account recovery page is the way back in. We cannot recover an account for you.

What we can and cannot tell you

We cannot tell whether someone is sending email as you. Nothing we offer watches your mailbox or the mail sent in your name.

What we can do:

• Reveal Impersonation. We check every day for look-alike versions of your domain and tell you what we find. You can add it in Build & Price.
• The Reveal Scan checks one Windows computer: the programs on it, how it is set up, and whether the programs set to start automatically match a list of known malware. Those lists hold only malware someone has already found, and the scan does not look at browser extensions or anything running only in memory, so it cannot prove a computer has none. What the malware check covers.
• For an office, a Second Opinion scans all your computers (Windows, Mac and Linux) and gives you one report that says what to do next. We set it up with you directly.