Someone is spoofing my company in emails: what to do

Three different situations

1. A forged sender with exactly your domain. The "From" field shows a real address in your domain, but a stranger sent the message from their own server. This is possible when the domain has no DMARC record with an enforcing policy.
2. A lookalike domain. The address looks similar: a typo (firrna.com instead of firma.com), a different ending (.net instead of .com), an addition (firma-invoices.com). It is a separate domain owned by the fraudster, and your domain's DMARC will not block it.
3. A hijacked account. The message really did leave your mailbox because someone knows the password. This is often accompanied by a hidden mail forwarding rule.

How to tell which case it is

Ask the recipient to forward the suspicious message as an attachment or to send you its headers. Check the address in the "From" field carefully, letter by letter, not just the display name: fraudsters often sign with your company name over a completely unrelated address. If the address differs from your domain, it is a lookalike (case 2). If the address is yours, find the Authentication-Results line. A DMARC fail with an unknown sending server most likely means a forged message (case 1); a fail can also come from one of your own services that lacks SPF and DKIM. If SPF, DKIM and DMARC all pass, the message left servers authorized by your domain, so most likely a hijacked account (case 3).

What to do in each case

Forged sender with your domain

Deploy DMARC: start with p=none and reports, after reviewing the reports move to p=quarantine, then to p=reject. With p=reject, recipients that apply DMARC (including Gmail, Yahoo and Microsoft) reject forged messages carrying your domain. Clean up SPF and DKIM first, otherwise genuine mail will be rejected too. Instructions: DMARC guide.

Lookalike domain

Report the lookalike domain to its registrar (WHOIS gives its name) and to the hosting company. Also report the incident to your national CERT or your country's cybercrime reporting service. You can register the most important variants of your domain (popular endings, obvious typos) yourself before someone else does.

Hijacked account

Change the mailbox password, turn on two-factor login, sign out all sessions and check the forwarding rules and filters. If the account was taken over, warn the contractors you have corresponded with in recent weeks.

Always: warn your customers

Whatever the case, write to your customers that your company's bank account number has not changed and that you confirm every request to change it by phone, on a known number. This is the most effective protection against invoice fraud, because it works even when the fraudster uses a lookalike domain.

The free audit shows whether your domain can be spoofed (the "Brand protection" section) and whether the registry already holds confusingly similar domains with a mail server ready to send.