Someone is impersonating my company by email: what to do now

A customer forwards you an email and asks whether it's genuine. It's signed by someone on your sales team, it has your logo in the signature, and it says your bank details have changed. Nobody at your company sent it. Look at the sender's full address and there is your company name with a word added, on a domain you have never owned.

Someone has registered a lookalike of your domain to write to the people who trust your name: the customers who pay your invoices, the suppliers who take instructions from your finance team, and sometimes your own staff. The customer who forwarded it is probably not the only one who received it.

Money already sent? The customer who paid should call their bank now and ask it to recall the payment. The first 24 to 72 hours matter most. Then report it, as step 3 explains.

You can do every step below yourself. Steps 1 to 3 are yours whatever happens, because they are about your people and your customers. Steps 4 and 5 mean writing to every company involved, following up until each one acts, and starting again when the next domain appears. DefendDomain can do that part for you.

First, check what you are dealing with

Ignore the display name, which anyone can set. Look at the full address the email came from, and at the reply-to address, which can be different. It will be one of three things, and each has a different fix.

• A lookalike of your domain. Your name misspelt, on a different ending, or with a word added, such as yourcompany-invoices.com. Someone registered it to impersonate you, and this guide is for you.
• Your exact domain. If the address is exactly yours but the email did not come from your systems, your domain is being spoofed. That is fixed at your end: ask whoever runs your email to enforce DMARC on your domain, so that receiving servers reject mail your systems did not send.
• One of your real mailboxes. If the email really did come from one of your accounts, that account has been compromised. Treat it as a security incident: reset the password, check the mailbox for forwarding rules nobody set up, and call your IT provider, and your cyber insurer if you have one.

Was our email hacked? Not necessarily, even when the fake email quotes a real invoice number or a recent call. That detail can come from a mailbox on the customer's side, or from anyone either of you has emailed. Check anyway: look in your own mailboxes for forwarding rules nobody set up and sign-ins from places you do not recognise, and ask the customer to check theirs. A lookalike domain and a hacked mailbox can turn up together.

If the lookalike also shows a copy of your website, our guide to cloned websites covers that side. If the impersonation is a fake social media profile or business listing, report it through that platform's own reporting tools, since only the platform can remove it.

Step 1: Warn your finance team and everyone being written to, today

Do this first, before the evidence is tidy. A bank transfer can leave a customer's account the same day it is requested, and a warning that arrives tomorrow may be a day late.

Start inside. Tell finance, sales and customer service what the lookalike address is and what the emails say, so anyone who is asked gives the same answer. Anyone who pays suppliers or changes bank details should confirm every change by phone, on a number they already hold, until this is closed. The domain writing to your customers can write to your staff too, and an urgent payment request from “the chief executive” is the same attack pointed inwards.

Then warn the customers and suppliers who received it, and the accounts teams you invoice regularly, because they are next in line. Keep it short and factual, and, in a private warning, give the lookalike address so their team can block it.

The most useful sentence in that warning is a rule their accounts team can apply to any email, including the ones you never hear about: we will never change our bank details by email alone.

Something like this is enough:

Someone is sending emails that pretend to come from us, from [the fake address]. We have not changed our bank details, and we will never change our bank details by email alone. If you get an email asking you to pay a new account, call us on the number you already have before you pay anything.

Step 2: Keep the evidence

Everything after this runs on it: the takedown requests, a police report, and any conversation between your customer and their bank. Collect:

• The emails themselves, forwarded as attachments or saved as files, so the full headers travel with them. A screenshot or a pasted copy loses the headers, and the headers show where a message really came from.
• The lookalike domain, and every address used on it, including any reply-to.
• Who received each email, and when.
• Anything attached, such as a fake invoice or a letter on your letterhead.
• Any replies your customers sent, and what came back.

If you only have an email on your phone, keep it and do not delete it; you can forward it as an attachment later from a computer. Ask customers to forward what they received rather than describe it. And do not reply to the lookalike or try to catch the sender out. It warns them, and they can move to a new domain before you have dealt with this one.

Step 3: Find out whether anyone has replied or paid

A quiet inbox does not mean nobody has paid. The first email often asks for nothing. In one case we have written up, the attackers told a company's trade customers that its receivables had moved to a new factoring arrangement and asked them to reply for “updated, verified” bank details. The first email carried no bank details, so filters had nothing to flag. The account number only arrived once a customer replied.

So ask every recipient two questions: has anyone replied, and has anyone paid? If money has gone, the customer who sent it should call their bank straight away. The sooner the bank knows, the better the chance of stopping or recovering the payment. They should also report it: in the UK to Report Fraud in England, Wales and Northern Ireland, or to Police Scotland on 101; in the US to the FBI's Internet Crime Complaint Center; and elsewhere to the police in their country.

When a customer pays the wrong account, the loss starts with them and comes back to you: an invoice they believe is settled, an argument about who carries the loss, and a customer who reads every email from you twice from now on.

Step 4: Get the domain and its mailboxes shut down

A lookalike that only sends email comes down when the companies behind it act, and for one domain that can be several:

• The registrar, the company it was bought through, which can suspend the domain and every address on it. A free lookup at lookup.icann.org shows the registrar and its abuse contact.
• The email providers it sends through, and there can be more than one. In the case above, the domain sent through several email platforms at once, behind shell company names, so that losing one would not stop the rest.
• The DNS provider, the company that holds the domain's settings, which can also switch off the records its email depends on.
• The blocklists that email security products draw on. A listing protects people who have never dealt with your company, and it works while the removal requests sit unanswered. In the case above, the domain was on major anti-phishing blocklists the same day, which hurt its delivery on every platform it used.

Report the emails as well. In the UK, forward them to the National Cyber Security Centre at report@phishing.gov.uk. In the US, report them to the FBI's Internet Crime Complaint Center. Elsewhere, report them to the police or national cyber security agency in your country. Ask the customers who received them to do the same.

How fast any of them acts depends on the report, and a domain with no website is a harder case to make than a cloned site. Anyone reviewing it can visit the address and find nothing there, so the report has to prove the impersonation from the emails: the headers, the lookalike next to your real domain, and what the messages asked for. Doing it yourself means writing that report again for each company, because each has a different abuse form, asks for different evidence and works through its own queue.

Step 5: Chase every report until it stops sending

Once the reports are sent, each company decides when to act, and that wait is the longer part. Reports come back marked “not our customer” or “contact the registrar”, tickets close without anything changing, and the same evidence goes out again to someone else. Someone has to phone help desks, answer every ticket, and push for an escalation when nothing moves.

Someone also has to keep checking whether the domain can still send. A closed ticket does not mean a dead mailbox. Even when you get its email accounts closed, the attackers can move quickly to another email provider. In the case above, they added a new sending platform partway through, and that had to be reported too.

That work tends to land on the finance director or the head of IT, often at month end: phone queues and ticket threads spread over days, while their own work waits.

If a lookalike is writing to your customers right now, this is the part to hand to us. Report a live attack and one of our team calls you back, usually the same working day. If you go ahead, we send the reports, chase them on a set schedule and check every hour whether the domain is still live.

Step 6: Assume it is not the only one

Registering a domain costs little and takes minutes. In about three out of four of the attack campaigns we have seen, the attackers registered a cluster of similar domains, not a single one. We have seen the next one registered in the same second as the first, ready for when the first is shut down.

So taking this one down is rarely the end. Be ready for the others: find out what else is registered around your name. Our free scan shows which lookalikes of your domain are registered and which of them can send email. Check the results against the domains your own company owns, then look hard at any that can send email and that nobody recognises. Look for your name with words added, not only misspellings: the domain in the case above was a brand name with a product word attached, and typo checkers do not generate that shape.

Ideally, more than one of them comes down. A registrar will not normally act on a lookalike that has not been used yet, but it sometimes will when the evidence ties it to the one already used against you: the same registrant, the same registration time, the same email set-up. So report the lookalikes you find together, with that evidence, not one at a time. Whether the unused ones come down is the registrar's call, which is one more reason to keep everything from step 2.

Why your email security did not stop it

Most companies that end up here already have SPF, DKIM and DMARC set up on their domain, and many pay for an email security product too. It is fair to ask why none of it helped.

The emails never touched your systems. They went from the attacker's email provider straight to your customers' inboxes, so your own email security never saw them.

And DMARC answers a question the lookalike passes. It asks whether an email really came from the owner of the domain it claims to come from. That protects your exact domain, and it is worth having: if your policy is not yet set to reject, fix that this week. But the attacker owns the lookalike. They can set up the same authentication for it that you have for yours, and their email can pass the same checks.

What protects your customers from a lookalike is the domain being found and shut down, and that needs someone watching for it. Read more on what DMARC can and cannot do.

How to hear about the next one before your customers do

This time, you heard about the lookalike from a customer, after it had already written to them. The time between the day it was registered and the day that email reached you is where the cost came from, and it is the part you can change.

Sometimes that window is days. In a campaign Microsoft's security team described in September 2026, more than a million emails went out over three days in early August, impersonating the targets' own executives and a well-known software vendor, and asking accounts payable teams for payments of nearly $50,000. The lookalike of the vendor's domain had been registered three days before the first email. Sometimes the window is far shorter: in one case we handled, a replacement fake domain was registered and sending fraud emails 28 minutes later. Either way, the watching has to be continuous.

How closely to watch comes down to what a lookalike would cost you.

If you run a small business, run our free scan every week or two. The scan is a snapshot of what is registered today. It will not tell you when an empty lookalike is set up to send email next week, and it does not take anything down, but for some lookalikes, you will see the registration yourself rather than hear about it from a customer.

If a lookalike would cost you customers, payments or supplier relationships, the watching has to be continuous, and running the takedown should be somebody's job rather than a month-end side task. DefendDomain re-checks lookalikes of your domain and your company name every hour, including your name with words added, and flags each one that is set up to send email, even if it never hosts a website. The evidence is gathered with the alert. When you confirm it is being used, one click sends it to every place that can act, we follow up automatically, and we tell you when it goes offline. After that we keep watching and alert you if it comes back. For finance teams, here is how that protects invoices and payments.

Why this cannot wait

Every day the lookalike keeps sending is another day of invoices paid to the wrong account, suppliers taking instructions from someone who is not you, and staff answering requests from a chief executive who never sent them.

So start today. Warn finance and the people being written to, keep the evidence, and get the reports moving yourself, or report a live attack and one of our team will call you back, usually the same working day. Then find out what else is registered around your name with a free scan.

Frequently asked questions