My Email is Sending Spam to My Contacts – What Should I Do?

Your email is suddenly sending spam to your contacts. You didn’t send any of the messages but they appear to come from your email address, damaging your reputation and risking security for your contacts. Is this spoofing or a compromised email account? Do you need to change your password, notify your contacts, and report the issue? You would be wise to act quickly. Some simple forensics, based on an understanding of how email works, may enable you to regain control and reopen communication lines. What you may not know was that your email account had been hacked. This is not an uncommon occurrence, but it is a big headache when it happens to you. 

94% of all malware is delivered by email, WatchGuard tells us. It’s safe to say that this is now one of the most important aspects of information security that we have to pay attention to. Because these events are becoming so common, we need to shore up our defenses and pay close attention to our accounts.

Is your email address sending spam email?

Here are some tell-tale signs:

• Your contacts are receiving emails you didn’t send.
• Your inbox is filled with undeliverable bounce-back messages.
• You notice unexpected changes in your account settings.
• You get alerts from your email provider about suspicious activity.

If any of these issues happen to you, this is when you should act. Email spam sent from your account can undermine your credibility, as well as harm the trust others have in you. Your contacts are also at risk of suffering from those phishing attacks and/or malware. You can limit any fallout and keep your digital stability – but you have to act quickly. If you wait, you make your problem worse and your task of restoring credibility and securing your account will be harder. Immediate steps to diagnose the problem can avert more damage, and restore the trust of your contacts.

Common ways hackers can get access to your email

Knowing what steps hackers take to break through your email’s defenses helps you avoid such incursions in the future. Here’s a list of their common tactics:

Spoofing

Spoofing attacks don’t even require one of the attackers to access your actual email account. The attacker simply forges your address, manipulating the email headers so that it looks like you are the one sending the spam. You’ll end up with a load of bounce-back emails in your inbox.

It’s hard to stop spoofing altogether, but if you’re wondering how to stop someone from using your email address for spam, one of the best ways is to set up authentication (also known as SPF records). This way, you inform the rest of the internet which server should be sending your emails. Contact lists are another way to combat spam. If you can help your contacts recognize a spoofed email, they are less likely to fall for it. In other words, technical and educational measures will set up a great firewall to resist the spoofing attack.

Compromised email account

If your email account has been compromised, it means that hackers have obtained access to your email account. Compromised email accounts are more serious issues and can result in a lot more damage: from spam messages being sent to your contacts, subverted attackers reading your email, or even attacks on your account settings. It’s important to secure your email account immediately to minimize the damage and regain control of it.

How to protect yourself

Email is one of the primary ways of communication, so protecting the account is a crucial thing to secure. There are several ways of doing this:

1. Use WOT’s anti-phishing and data breach monitoring features

Web of Trust (WOT) has tools to help determine phishing, as well as track data breaches. One is Anti-Phishing, which warns you if you’re logging on to an illicit website.

Data Breach Monitoring tells you whether your emails – and perhaps your passwords – have been compromised. Taken together, they create a second line of defense for your inbox.

Besides making monitoring easier, it also adds a significant level of security by bringing more actionable threat intelligence to your fingertips in the form of warnings and protective actions that are unique to your exact circumstances.

2. Change your password immediately

When it comes to the first step, the first thing you should do is upgrade your password. Make it long, complex, and cryptic, with a mixture of upper- and lower-case letters, numbers, and special characters; don’t include common words or easy-to-guess details such as addresses or birthdays.

Strong passwords are a good start when it comes to keeping your accounts safe. If attackers did manage to gain access to your account without your notification, resetting your password ensures that they lose that access. Make sure you periodically change your password, and use a password manager if possible, which automatically generates complex passwords that you needn’t remember and securely stores them for you.

Read more: How Long Will It Take to Crack My Password?

3. Enable multi-factor authentication (MFA)

Multi-factor authentication, also known as MFA, is an additional security layer beyond just your password. This extra layer of defense can be an unlock code that is sent to your phone or a biometric reading such as your fingerprint. In the first case, the secondary verification is received through a text message to your phone, while in the second it’s from your authenticator app if you use one of those or your fingerprint.

MFA is extremely effective because even if a hacker gets your password, they will still have a difficult time getting past the secondary login. MFA is a critical defense, and if your account is set up to use this measure, it makes it all the more difficult for an attacker to even try to access it.

4. Regularly monitor account activity

Check your email account to see if there have been any new logins or configuration changes you didn’t recognize; most providers offer reporting of IP address and location of recent logins, which makes this pretty easy. Catching intruders early reduces the chance of serious damage.

Doing periodic reviews will keep you on alert for suspicious activity. You can also set up alerts to notifications of unusual login attempts. Monitoring reporting tools combined with notifications of unusual activity can help you take action on possible breaches.

5. Inform your contacts

Let your contacts know as soon as you realize your email has been hijacked. Advise them that they shouldn’t click on any links or download any attachments from emails you’ve sent them in the past few hours. It’s also a good idea to inform them that you’ve figured out what happened, so they can keep an eye out for other suspicious activities that are using your name. When you take the initiative to protect your contacts’ security, it will reassure them and reinforce their trust in you. Describing what happened and why to jittery contacts can help them regain their confidence in your security awareness.

6. Scan for malware

Install a trustworthy antivirus software and run a full malware scan on your devices to find and remove any malicious software that may have been exploited in the breach. A successful malware scan will find and quarantine any dangerous software on your device. Performing scans and routinely updating your antivirus software will help protect your device.

Make sure to keep all security software up to date so that you have the latest patches to safeguard against the newest threats. If the hacker has exploited an operating system or an application that you are running, keeping your operating system and applications updated will help to keep you safe against these known vulnerabilities. Your security toolbox and your regular checks should be as strong as they can be to help mitigate any potential malware infection.

Don’t wait for the next big security breach

An email security breach can come with major personal and professional consequences. Don’t wait for your next major headache. Implement the safeguards we’ve talked about, and use tools such as WOT to take an extra layer of security. By taking these precautions you can help to keep your email safe and your communications secure. And by doing that, you contribute to the sanctity of the whole email protocol and the value and trust that should come with it.

FAQs

How can I secure my email account?

Protect your email account by using strong and unique passwords, enabling multi-factor authentication, and checking your account regularly for activity. Use multiple, unique passwords to avoid breaches. Keep antivirus software on your devices up to date and scan regularly for viruses or malware to avoid attacks.

What should I do if I receive a suspicious email?

Should you receive an email that raises suspicion, don’t click on any links or download attachments, but report it as spam or phishing to your email provider, and alert the sender if it appears their account may have been compromised. Contributing to the filtering of such emails at the source works actively to prevent their arrival in your inbox.

How can I prevent my email from being spoofed?

While you can never completely eliminate spoofing, you can set up mail authentication protocols (such as SPF, DKIM and DMARC) to give email servers a means of verifying that messages from your domain are really from you. You can also educate your contacts on recognizing spoofed emails, which would diminish the effectiveness of these spoofing tactics.

What are some common signs of phishing emails?

Urgent requests, requests for personal details, and strange links or attachments are just some of the common red flags for phishing emails. Another warning sign of a phishing email is bad grammar and poor spelling. If the sender’s email address looks dodgy, do not open the email. You should also be aware that phishing attacks can be very sophisticated. That’s why it’s important to pay attention to these changing trends.

What should I do if my email is hacked abroad?If your email account was hacked while traveling, change your password, use any available multi-factor authentication, and contact your email provider for further help and advice on securing your account. Having thought-out backups and secure connections in place in advance of traveling will help protect your email accounts in foreign lands.