Threats sent from your own address: why extortion e-mails show you as the sender

Security·· 32 views· 3 min read

The short answer: you received an e-mail that seems to come from your own address, saying your mailbox or computer was broken into and demanding cryptocurrency to keep quiet. It is almost always fake: the sender of an e-mail is just text anyone can type, like the return address on a letter. Do not reply, do not pay and do not click anything. Then check two simple things, below.

Why it looks like it came from you

The "From" field is not checked by whoever sends the message, and the scammer types your address there to scare you: "if I send from your address, I must be in your account". They are not. The message left some server far from ours. If you open the header, the Received lines show where it really came from: how to read the header.

Sometimes the message quotes a real password of yours. That is scarier, but it has another explanation: the password came from an old data breach at a site you signed up to, and it sits on lists that are sold online. It does not mean your mailbox was broken into, but it does mean that password is worthless now.

What to do

1 Do not reply and do not pay. Replying confirms a person reads the address, and paying only brings more messages.
2 Mark it as spam in webmail or your e-mail program, and delete it.
3 If it quotes a password you still use, change it now everywhere you use it, starting with the mailbox: changing a mailbox password.
4 Check the mailbox is not sending by itself: look at the Sent folder in webmail. If there are messages you did not write, then there is a real problem: follow what to do when the account was hacked.

How to see fewer of these

Your domain's DMARC record tells receiving servers what to do with messages that use your domain without permission. With a stricter policy, many of these fakes are rejected or sent to spam, in your customers' mailboxes and in yours. See someone is sending e-mail in the name of your domain.

Do not open attachments or links in these messages. Some carry a "proof" that is really malicious software. If you already opened one, see what to do if you clicked.
Warn the team. These messages often reach several people in the company at once. A short warning stops someone paying out of fear.

Got one of these and want to be sure your mailbox is safe? Open a ticket and we will check with you.

Open a support ticket

SEE ALSO

Someone is sending e-mail in the name of your domain: what SPF, DKIM and DMARC do about it

How to recognise a phishing e-mail or message, and what to do if you clicked

Your e-mail account has been hacked: what to do in the first hour

Reading an e-mail header: did SPF, DKIM and DMARC pass?

How to change an e-mail account password

A strong password and a password manager: how to stop reusing the same one

RECOMMENDED PRODUCT

Professional e-mail on your domain

Mailboxes in your company name, no adverts, with spam filtering. from $6.60/mo (3-year plan, with coupon)

See plans
Was this answer helpful? Your answer helps us improve this article.

Related Articles

Security 2,319 What is an SSL certificate and why does it matter? An SSL certificate encrypts the connection between a visitor's browser and your site, so passwords, card numbers and any...
Security 2,353 Why does my SSL certificate show fewer than 365 days? If you're on the free SSL every account gets by default, this doesn't apply to you - skip to the note below. This is onl...
Security 3,958 How to redirect HTTP to HTTPS with .htaccess This forces every visitor to the encrypted version of your site, even if they type or link to the plain http:// address....
Security 2,255 How to tell if your site has been compromised Most infections don't announce themselves - they show up as small, odd symptoms before anything looks obviously wrong. S...
Security 2,136 How to clean up a compromised site Cleaning up is only half the job - if the door that let the infection in stays open, it comes back. Work through this in...
Security 45 Reading your e-mail on a shared or public computer: before, during and after The short answer: on a computer that is not yours (an internet café, a hotel, a colleague's), open webmail in a private...