Invoice fraud and BEC crews
The highest-value abuse. They email your customers a real-looking invoice with their bank details, or email your finance team as your CEO. The money moves before anyone phones to check.
Why this happens
Someone is sending email as your domain. Here is who, and why.
You do not have to be hacked for this to happen. Email was designed without sender verification, so putting your domain in the From line costs an attacker nothing. This is who does it, why they picked you, and what you can actually do about it.
Who sends email as your domain
Six senders turn up again and again. Only some of them are attackers.
Credential phishers
A password-reset or shared-document notice from your domain gets clicked far more often than one from a stranger.
Bulk spammers
They do not care about you specifically. Your domain is disposable cover that gets them past filters. Your domain absorbs the reputation damage; they move to the next one.
Malware and ransomware operators
An attachment from a known supplier gets opened.
Extortion spam
"I sent this from your own domain, which proves I control your systems." They did not. Anyone can do it. But it is convincing enough to get paid.
Your own legitimate senders, unauthenticated
Invoicing tools, the CRM, a marketing platform, a plugin someone installed. Sending real mail on your behalf, not authorised to. In the reports these look identical to an attacker until someone identifies them.
Why they pick your domain
It is rarely personal. It is that your domain works better than theirs.
Trust is the whole product
Recipients act on mail from a name they know. That is the only asset being stolen.
It costs nothing and takes seconds
No hacking, no breach, no access to your systems. Email was designed without sender verification; claiming to be you is a line of text.
Aged, legitimate domains get delivered
A brand-new spam domain gets filtered. Yours does not.
Your contacts are public
Customers, suppliers and staff are findable - so are the relationships worth exploiting.
The consequences land on you
Complaints, blocklisting and the phone call from an angry customer come to you. The sender is untraceable and gone.
It is automated
Most domains are sprayed in bulk, not chosen. Handling payments or invoices moves you from sprayed to targeted.
What the reports usually actually show
For most domains the first look turns up more unauthorised legitimate senders than attackers - forgotten tools still sending as you. That is the practical starting point, and fixing it is what makes the attackers visible.
One honest limit
This stops people forging your exact domain. It does not stop a lookalike domain, a spoofed display name, or a genuinely compromised mailbox.
What each of those means
A lookalike domain is a different domain registered to resemble yours. It is not your domain, so nothing you publish for your domain governs it.
A spoofed display name puts your company name in front of an address that is not yours. The name is what most people read; the address is what is checked.
A compromised mailbox sends genuinely authenticated mail, because the attacker is signed in as a real user. It passes every check by design.
Find out where your own domain stands
The check is free, needs no signup and no access to your systems. It is the front door to everything on this page.