Is a Scammer Using Your Email Address? (Email Spoofing)

A friend calls and asks, “Did you really email me asking for gift cards?” Or a strange message lands in your inbox that seems to come from your own address. It is unsettling, and it raises an urgent question: has a scammer broken into my email, or are they just pretending to be me? Scams using your email address come in two kinds: a hacked account, or a spoofed address that only looks like yours.

This guide explains the difference, how to check, and exactly what to do in either case.

Was your email spoofed or hacked?

Spoofed means a scammer is making messages look like they come from you, without being inside your account. The FBI’s Internet Crime Complaint Center defines phishing and spoofing together as unsolicited email, texts and calls that pretend to come from a legitimate source to get personal, financial or login information. The same trick is used with phone numbers: the FTC warns that some scammers even send texts that appear to come from your own phone number.

Hacked (or compromised) means someone actually got into your account — usually with a stolen or guessed password — and can read your mail and send messages as you.

It can also be a third thing: a virus on someone’s computer. CISA, the federal cybersecurity agency, notes that a familiar “From” address does not guarantee safety, because some viruses spread by searching an infected computer for email addresses and sending themselves to those addresses, disguised as email from the computer’s owner.

EXAMPLE — SCAM

Today 9:02 AM●●● ▮

From: Your Name <you@mail.example.com>

Subject: Quick favor — are you around?

Hi, I’m in a meeting and can’t talk on the phone. I need to get a few gift cards for my niece’s birthday today but I’m stuck. Could you pick up four $100 cards and send me photos of the backs? I’ll pay you back tonight. Thanks so much.

How can you tell if your email was hacked?

The FTC lists these signs that an email or social media account has been hacked:

• You can’t log in to your account.
• You get a notification about a change to your username or password that you didn’t make.
• You get an alert that someone logged in from a device you don’t recognize.
• Friends or family say they’re getting emails or messages you didn’t send.

Then look inside your account:

• Sent folder: are there messages you didn’t write?
• Deleted folder: the FTC notes an intruder may read and then delete messages.
• Forwarding rules: delete any rule you didn’t set up — it could be sending copies of your mail to someone else.
• Recovery details: make sure the backup email address and phone number are yours.

If you find any of these, treat your account as hacked and lock it down right away, using the steps below. If you find none, your address may be spoofed, but those steps are still a good idea.

How do you lock down a hacked email account?

The FTC recommends these steps:

1. Scan your device. Make sure your computer’s security software is up to date, then run a scan. Delete anything it flags and restart your computer.
2. Change your password to a strong one that is hard to guess. If you used the same password anywhere else, change it there too.
3. Sign out of all devices, so anyone else who is logged in gets kicked out.
4. Turn on two-factor authentication, so a password alone isn’t enough to get in.
5. Check your recovery email and phone number and fix them if needed.

If you can’t log in at all, use your email provider’s official account-recovery process. Type the provider’s address into your browser yourself rather than following a link in an email.

What should you tell your contacts?

Send a quick email, text or post to your contacts. The FTC suggests telling them about the problem and asking them not to click links in emails from you and to ignore any pleas for help or money. That message alone can stop a friend from buying gift cards for a scammer.

Is the “I hacked you” blackmail email real?

A related scam arrives in your inbox claiming the sender hacked your computer and recorded you, and threatening to share the video unless you pay in Bitcoin. Sometimes it includes one of your real old — or recent — passwords, which the FTC says probably came from a data breach.

The FTC’s advice is short: stop, don’t pay anything, delete the message — it’s a scam. If the email includes one of your passwords, change it, and consider whether other passwords need changing too.

Be careful with companies that promise to make the threats stop. In October 2026 the FTC said it sued the operator of Digital Forensics, which ran sites including BlackmailHelpline.com, for falsely promising to stop sextortion threats while charging people thousands of dollars. Real help is free: the FTC says to report a blackmailer to local police and to the FBI at tips.fbi.gov or 1-800-225-5324, and to ignore and block the blackmailer instead of paying.

What if you clicked a link or shared information?

• Entered your email password on a strange page: change it immediately and follow the lock-down steps above.
• Shared financial information or your Social Security number: go to IdentityTheft.gov and contact your bank.
• Lost money: follow our first-hour checklist.

Where do you report email spoofing?

Report scam emails to the FTC at ReportFraud.ftc.gov, and forward phishing emails to reportphishing@apwg.org. If someone took over your account, stole money or used your identity, also file a complaint with the FBI at IC3.gov. See how to report a phishing email for step-by-step instructions.

To learn what phishing emails look like — including ones that pretend to come from people you know — see phishing email examples and 7 red flags.

For more on fake emails and look-alike websites, see our overview of phishing emails and fake websites.