Phishing

Someone Is Sending Emails Pretending to Be Your Business. Now What?

Imagine discovering that several of your customers received emails that appeared to come directly from you. The sender used your name, represented your business, and contacted people with whom you regularly communicate. However, you never sent those messages. And the email address belonged to someone else entirely.

For small business owners, this situation raises two immediate concerns:

1. Someone is attempting to exploit the trust you’ve worked hard to establish with your customers.

2. How did the impersonator know which customers to contact?

At 208Geek in Meridian, Idaho, we help residential and small business customers understand computer security threats and investigate suspicious activity. Email spoofing and business impersonation deserve particular attention because an attack can affect your reputation even when criminals haven’t gained access to your accounts.

Email Spoofing or Phishing Doesn’t Always Mean Your Account Was Hacked

One of the most unsettling aspects of business impersonation is that criminals don’t necessarily need access to your email account to pretend to be you. They can create a similar-looking address, called phishing, or use your business name as the sender’s display name, and write messages that resemble your usual correspondence.

For example, someone might register a domain containing an extra letter or substitute a slightly different spelling of your business name. When recipients see a familiar name, they may overlook the difference.

It’s also important to distinguish between two related techniques:

• Email spoofing: Manipulating sender information to make an email appear to originate from another person or organization.

• Lookalike email impersonation: Creating and using a separate email address or domain that closely resembles a legitimate one.

Neither technique, by itself, proves that someone accessed your computer, stole your password, or entered your email account. However, both deserve investigation, particularly when the messages reach actual customers.

How Did Criminals Find Your Customers’ Email Addresses?

This is often the most troubling question, especially when recipients aren’t random strangers but people with whom you regularly do business. Unfortunately, there isn’t always an immediately identifiable answer. Criminals can assemble surprisingly accurate contact lists without necessarily accessing the business owner’s email account.

Several possibilities deserve consideration:

• Publicly available information: Websites, business directories, social media accounts, and professional networking platforms can reveal relationships between companies and individuals.

  
  

• Previous data breaches: Email addresses exposed through unrelated websites or services may eventually become available to criminals.

  
  

• Compromised customer accounts: An attacker who accesses one customer’s email account may discover conversations and contact information involving other businesses.

  
  

• Third-party service providers: Customer relationship management systems, mailing platforms, and other connected services may contain valuable contact lists.

  
  

• Unauthorized mailbox access: If criminals gain access to an email account, they may collect contacts, review previous conversations, and identify frequent correspondents.

The distinction matters because identifying the actual source of the information requires evidence. Even if several regular customers receive fraudulent emails, that doesn’t automatically establish that the business owner’s contact list was stolen.

What Should You Do If Someone Impersonates Your Business?

Once you discover suspicious emails circulating under your name, responding quickly can help protect your customers and reduce further damage.

We recommend taking several steps:

1. Preserve the evidence. Save the suspicious messages, including their full email headers. These contain technical information that may help identify the sending infrastructure.
   

2. Check account activity. Review recent sign-ins, connected applications, forwarding rules, and other settings for unauthorized changes.
   

3. Secure your accounts. Change passwords when compromise is suspected, enable multi-factor authentication, and remove unfamiliar sessions or application access.
   

4. Warn affected customers. Explain that someone is impersonating your business and advise recipients not to open attachments, follow suspicious links, or respond.
   

5. Review email authentication. Verify that SPF, DKIM, and DMARC records are properly configured for your business domain.
   

6. Report the impersonation. Notify the relevant email provider and report suspected fraud to the Federal Trade Commission or FBI’s Internet Crime Complaint Center.

Customer communication is particularly important. A short, professional warning can help prevent additional victims while demonstrating that your business takes security seriously.

Can Email Security Settings Prevent Someone From Pretending to Be You?

Businesses that use their own domain names should understand three important email authentication technologies: SPF, DKIM, and DMARC. Together, these help receiving email systems determine whether messages claiming to originate from a particular domain are legitimate.

However, these protections have limitations. They can help prevent unauthorized use of your actual domain, but they cannot necessarily stop someone from registering a different, deceptively similar domain.

That’s why technical safeguards should be combined with account monitoring, secure passwords, multi-factor authentication, and customer awareness. No single security setting can eliminate every impersonation attempt.

Protecting Your Business Reputation After an Impersonation Attempt

Small businesses depend heavily on personal relationships. Customers recognize the owner’s name, trust familiar communications, and may be accustomed to receiving invoices, updates, and other information through email.

Criminals understand this. By impersonating someone customers already trust, they can make fraudulent messages appear more credible than an unsolicited email from an unfamiliar company.

Fortunately, discovering an impersonation attempt doesn’t automatically mean your business suffered a data breach. A careful investigation can help determine whether unauthorized account access occurred, whether additional precautions are necessary, and how to protect your customers going forward.

At 208Geek, we believe cybersecurity involves more than removing viruses or repairing computers. It also means helping business owners understand threats, investigate suspicious activity, and strengthen the systems they rely on every day.

About 208Geek in Meridian, Idaho

At 208Geek, we provide computer repair, troubleshooting, maintenance, and IT support for residential and small business customers in Meridian, Boise, and the rest of the Treasure Valley. From resolving computer problems to helping businesses improve their technology and security practices, we focus on practical solutions that keep computers and networks working reliably. Whether you’re concerned about suspicious account activity, need help securing your computer, or want dependable small business IT support, our team is here to help.