A few weeks ago we found out someone was impersonating our agency to reach our clients. It turned out to be two different things happening at once: fake lookalike email accounts pretending to be us, and forged emails that looked like they came straight from our real domain.
In case this has happened to you and you’re trying to figure out what to do, here’s what happened to us and what we did about it, in order.
How We Found Out
A client told us they’d gotten an email “from us” that felt off. It had come from a Gmail address made to look like our business name — not our real domain, just close enough to fool someone skimming their inbox.
That’s usually where this starts. Someone registers yourbusinessname@gmail.com or something close to it, then emails your actual clients or vendors with a plausible-sounding request. Often something urgent, like a payment change or an invoice update.
As we looked into it further, we found a second, separate method was also happening: someone was forging our actual domain in the “From” field of emails, sent from cloud hosting infrastructure, targeting specific clients directly. Two different tactics, running at the same time. That meant we needed two different responses.
Method 1: Lookalike Gmail Accounts
Report the account
First move: report the fake account. For Gmail that’s support.google.com/mail/contact/abuse. Give them as much as you can, including the full email header if you have it (in Gmail: three-dot menu on the email > Show original). Surprisingly, Google suspended the spoofed Gmail account almost immediately, which was encouraging.
One thing we learned fast: reporting one account doesn’t end it. We reported four or five different lookalike accounts over a few weeks. Each report gets that one account shut down, but nothing stops someone from making a new one five minutes later. Expect to do this more than once.
Alert your clients, and make it permanent
While the platform investigates, tell your clients right away, from your real domain. Give them the fake address so they can spot it, and set a clear rule they can rely on going forward.
We sent something like this:
“Heads up — someone has been sending emails impersonating our company using lookalike Gmail addresses. We will never contact you from a Gmail account, and we will never ask you to change payment details or act urgently over email. If anything from us seems off, call us directly before acting on it.”
We also added a line to our email signature saying the same thing: we only communicate from our official domain, and we’ll never ask for payment or account changes over email without a verified call. It’s not a one-time notice that gets forgotten. It’s on every email we send now.
This step matters more than any technical fix. You can’t guarantee you’ll catch every future attempt, but you can make sure it doesn’t cost your clients anything, by making them hard to fool in the first place.
Method 2: Forged Mail From Our Own Domain
This part is more technical, and it’s where most small businesses don’t know where to start. We didn’t either, at first.
The fix: DMARC, SPF, and DKIM
Three acronyms, plain English version:
- SPF — a DNS record listing which mail servers are allowed to send email “from” your domain.
- DKIM — a signature that proves an email wasn’t altered in transit and really came from an authorized sender.
- DMARC — the policy that tells receiving mail servers what to do when a message fails SPF or DKIM: ignore it, send it to spam, or reject it outright.
Most domains either have no DMARC record, or have one set to monitor-only, which watches but doesn’t actually stop anything. That was us too, until we fixed it.
Roll it out gradually
Don’t flip straight to full enforcement. If you do, you risk silently breaking legitimate email — an old marketing tool, a forgotten integration, a contractor sending mail on your behalf — before you even know it’s a problem.
A DMARC record is a single TXT record in your domain’s DNS. Here’s roughly what it looks like at each stage, over about three to four weeks:
- Start in monitoring mode, low enforcement:
v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@yourdomain.com
pct=25 means only a quarter of failing mail gets quarantined, which gives you a safety margin while you watch what comes in. The rua= address is where reports get sent.
- Point that address at an inbox you’ll actually check. You don’t need a whole new mailbox for this. An email alias that forwards into an inbox you already use works fine and costs nothing extra. Set up a folder rule so the reports don’t clutter your main inbox.
- Review reports for a week or two. This is where it gets genuinely hard without help. DMARC reports come in as raw XML files full of IP addresses, authentication codes, and cryptographic signatures, not a friendly dashboard. We used AI to analyze each report as it came in, which made it possible to actually work through the XML, tell legitimate mail apart from real spoofing attempts, and confirm every known sender was passing cleanly before moving on.
- Increase gradually, as your confidence grows:
v=DMARC1; p=quarantine; pct=50; rua=mailto:dmarc@yourdomain.com
v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc@yourdomain.com
- Once you’re seeing clean reports at 100%, move to full rejection:
v=DMARC1; p=reject; pct=100; rua=mailto:dmarc@yourdomain.com
At this point, forged mail gets bounced outright instead of flagged or sent to spam.
Doing this without AI would have been rough
Worth being honest about this part. Reading a raw DMARC XML file for the first time is intimidating unless you provide IT support or have similar experience. Realistically, we wouldn’t have been able to keep up with this on our own, or we’d have had to pay a consultant to do it for us.
Instead we leaned on AI through the whole process: uploading each report, having it explained in plain language, flagging what looked like real spoofing versus routine noise, and figuring out what to do next at each stage. That’s not a small detail. It’s probably the one thing that made this level of ongoing monitoring realistic for a business our size. We caught real, targeted attempts against specific clients because we were actually able to review reports as they came in, instead of letting them pile up unread because we didn’t know where to start.
Document the pattern
If this happens more than once, and it probably will, treat it as a pattern instead of separate incidents. We filed a report with the FBI’s Internet Crime Complaint Center (ic3.gov) laying out the full timeline: every account, every attempt, every step we’d already taken. A single incident often doesn’t get much attention. A documented, repeated pattern against the same business is a stronger case.
We also used AI to help pull together the complaint itself. Figuring out which details actually mattered, and getting them organized clearly, made a real difference. It’s easy to either leave out something useful or bury the important parts in too much detail.
The Takeaway
You can’t stop someone from registering a new lookalike account tomorrow. What you can do:
- Lock down your real domain so it can’t be forged outright, with DMARC, SPF, and DKIM properly enforced
- Give your clients a clear rule to rely on, backed up by something as simple as your email signature
- Actually keep monitoring what’s happening with your domain, instead of giving up because the reports are unreadable
- Keep a documented trail in case it becomes a pattern worth escalating
If you’re dealing with something similar, don’t panic, but do be proactive. Notify your clients quickly and directly, and take a real look at your domain’s email security. This isn’t a service we offer. We’re primarily an ecommerce, WordPress and SEO shop. But we went through this recently enough, and it was disorienting enough, that we wanted to write down what actually worked in case it helps someone else going through the same thing.