Someone is sending fake emails in your business's name. Here's what to do.

A customer calls: “I got your email about the new bank account. Can you confirm?” You never sent it. It's scary, and it's common. In 2025 the FBI received 24,768 reports of business email scams, with more than $3 billion lost. The good news is that there's a clear way to handle it.

First: a fake sender, or a hacked account?

These are two different problems with different fixes. Ask the customer to forward you the email (forward, not reply), then look for these signs.

Signs it's a fake sender (your account is fine)

• The email isn't in your Sent folder.
• The address is slightly different, like yourbusiness.billing@gmail.com or billing@yourbuisness.com.
• Or the address looks exactly like yours, because your email settings don't tell inboxes to block fakes. You can check that in seconds with the free check.

Signs your account was hacked

• The email is in your Sent folder or in Deleted Items.
• Customers got replies you didn't write, in the middle of a real conversation.
• You find forwarding rules or filters you didn't create.
• You got alerts about sign-ins from places you've never been.

If you think your account was hacked, change your password now from a different, trusted device. Then keep reading.

Today: protect the money and your customers

1. If anyone sent money, call their bank right away and ask them to try to recall the payment. Speed matters: the sooner the bank knows, the better the chance.
2. Report it to the FBI at ic3.gov. It's free, and the report helps banks and police.
3. Warn your customers with a short message from your real email or your social media. You can copy this one:

Heads up: someone is sending fake emails pretending to be [Your Business]. We will never ask you to change payment details by email. If you get a message like that, don't reply. Call us at [your number] to confirm.

4. If your account was hacked: change the password, turn on 2-step login, delete any forwarding rules you didn't create, and sign out of every other device. In Microsoft 365 and Google Workspace, you can also review recent sign-ins.

This week: close the door for good

Fakes that use your exact address are stopped by three public settings on your web address. Gmail, Outlook and other inboxes check them on every message:

• SPF: the list of services allowed to send email for you.
• DKIM: an invisible signature on your real emails.
• DMARC: the instruction for what to do with anything that fails. To block fakes, it has to be set to reject.

It's common for small businesses to have DMARC missing, or set to “none”, which only watches. Fakes still get delivered. Run the free check to see yours. If it says High or Medium risk, I can fix it for you with Email Protection ($299, once), or your email provider can walk you through it.

Turn it on in steps. Blocking too early can stop your real invoices or newsletters. Start by watching, then send fakes to spam, then block.

What these settings can't stop

Even with perfect settings, scammers can still use a look-alike web address with letters swapped, or a free account with your business name, like yourbusiness.billing@gmail.com. So teach your team and your customers one simple rule: any request to change bank details or to pay urgently gets confirmed by phone, using a number you already know.

Quick checklist

• The suspicious email forwarded to you
• Bank called, if money moved
• Reported at ic3.gov
• Customers warned
• Password changed and 2-step login on, if you were hacked
• Free check run on your website
• SPF, DKIM and DMARC set to block fakes