Fake invoices in your company's name: how to protect your domain
Fraudsters send invoices with your sender address? Why that is technically possible, what it causes — and how DMARC with p=reject puts an end to it.
The scenario has become everyday reality: a customer calls because they received an invoice "from you" — with someone else's bank account number. Or an employee receives an urgent payment instruction "from the boss". The sender address matches exactly, and so does the logo. The reason is sobering in its simplicity: email technically allows ANY sender address to be entered — as long as the domain does not defend itself against it.
Why the sender address proves nothing
The visible sender of an email is a text field that the sender fills in freely — comparable to the return address on an envelope. Without SPF, DKIM and, above all, DMARC, nobody checks whether the writer was authorised to use it. Fraudsters need no hacked accounts and no access to your systems for this; any server anywhere in the world will do.
What is at stake
- Payment fraud against your customers — the money goes to a stranger's account, yet the trust relationship still suffers on your side.
- CEO fraud from the inside: instructions "from management" to your own accounting department.
- Domain reputation: if your domain is abused for spam waves, the deliverability of your GENUINE mail suffers.
The remedy: DMARC with p=reject
Against forgeries of your exact domain there is an effective, free countermeasure: set up SPF and DKIM properly and move DMARC step by step to p=reject. From then on, Gmail, Outlook, Yahoo and all other major recipients reject emails that carry your domain in the sender address but do not originate from your systems — before anyone reads them.
_dmarc.beispiel.atv=DMARC1; p=reject; rua=mailto:dmarc@beispiel.atImmediate checklist for an active incident
- Actively warn affected customers (by phone or a verified channel) and have the payment stopped.
- Preserve the headers of the forgery — they reveal the actual delivery path.
- Check your own domain and start the DMARC rollout plan: every week without reject is an open door.
- If there is damage: file a police report; in Austria every police station accepts cybercrime reports.
Frequently asked questions
Our domain was abused — have we been hacked?
Almost always: no. Sender forgery needs no access whatsoever to your systems. Checking is still worthwhile — but the actual gap is the domain's missing DMARC enforcement, not a break-in.
Does a note in our signature ("We never send bank details by email") help?
As a supplement, yes; as protection, no — the forgery simply carries the same signature. The only reliable measures are technical rejection through DMARC plus a second channel (a call-back) for any change of payment details.
How quickly does p=reject take effect?
Immediately from the moment recipients see the record — that is, within hours. The preparatory work (getting all legitimate sending services properly set up) is what takes weeks; the switch itself is a single DNS record.