What to do if you receive suspicious emails from your own email

Receiving an email that appears to be from your own address can be alarming, but in most cases, it doesn't indicate that your account has been accessed. Behind this is often a sender impersonation technique (email spoofing) that exploits protocol vulnerabilities to make the message appear legitimate when it is not.

Cybercriminals use this method to blackmail, spread malware, or steal data by appealing to urgency, shame, or fear to get you to pay in cryptocurrency or click on harmful links. Organizations such as INCIBE, the OCU, and security experts warn that these emails are fraudulent and recommend against giving in to blackmail or providing personal information. We'll show you how. what to do if you receive suspicious emails from your own email.

What is email spoofing and why are you receiving emails from “you”?

Email spoofing is a technique that involves falsifying the sender by modifying the message headers to make it appear to come from another source. As cybersecurity experts explain, the attacker modifies fields like "From" or the subject line to appear to be someone you trust—even yourself—without having accessed your account.

This is possible because the SMTP protocol, which governs email sending, does not require authenticating the sender on its own. Thus, with simple tools or APIs, anyone can set any "From:" address they want; the servers send the message, and the header visible in your inbox shows the address the attacker entered, even if it's not the real one.

The technical headers of the email (the full headers) reveal the true route of the message, Since they log every hop between servers in fields like Received:, most users don't check these fields before interacting with the content.

In addition to the From: field, scammers use “Reply-To” to redirect replies to another account they control, So even if the email appears to be sent by you or a contact, the reply reaches the attacker.

How these scams operate: from fake "hacking" to sextortion

One of the most common patterns is email sextortion: the attacker claims to have infected, recorded, or controlled your camera and threatens to distribute intimate videos if you don't pay within 48 hours, usually in Bitcoin. These messages often claim they've been monitoring you for weeks or that they used software that "turned on your microphone."

INCIBE clarifies that, in this type of campaign, the attacker has not accessed your devices nor has real videos, and that the main objective is to scare you into obtaining payment or your data. The OCU adds that they also seek to distribute malware through infected attachments or links.

Another variant is the fake “Pegasus” warnings or other “ultra-powerful” malware, with the claim that all your devices are compromised and that only immediate payment will prevent serious consequences. It's a classic example of social engineering based on urgency and fear.

Attackers play on shame to pressure you, They often demand cryptocurrency because it's difficult to trace. They sometimes include passwords leaked in data breaches to give them greater credibility, although this doesn't mean they actually have control over your accounts.

Signs to detect blackmail and phishing emails

Look for typical indicators: urgent financial demands (especially in cryptocurrencies), threats to post intimate content, and 24-48 hour deadlines. These recurring pressures are common signs of phishing and blackmail.

Also look for poorly written texts, spelling mistakes or “strange” phrases that indicate automation or poor translation, as well as disguised senders or addresses that do not correspond to the legitimate entity.

Be wary of requests for personal or banking information via email, links to “verify your account,” or to download software, especially if the message seems unusual or mimics your bank, supplier, or family contact. Always confirm through official channels.

If you receive a message purportedly from a well-known organization (such as a courier company) requesting a payment or upgrade via link, Remember that legitimate institutions do not request confidential data via email or send executable attachments.

How to check where an email really came from

Reviewing the entire header of the email allows you to confirm its real origin and the route it took. Compare the technical fields with the information visible in “From:”.

• Gmail: Open the message, tap the three vertical dots, and select “Show original.” You will see the complete code and the line From: authentic, in addition to authenticity checks.
• Outlook: open the message, right click and “Message Options”. Check “Internet Header” to verify Received:, From:, Reply-To:, and copy the header if you need to parse it.
• Yahoo Mail: Open the message, tap the three dots and select “View message source.” Examines the Received: entries and the original sender's IP to detect possible inconsistencies.

Outlook displays a “?” on the sender image when it cannot verify the identity, suggesting caution. If a regular contact doesn't usually appear with that symbol and suddenly does, they may be being impersonated.

Another clue is that if the “From:” address differs from the one in the header, You'll be able to see the authentic sender underlined, helping you identify fake emails.

What to do if you receive an email “from your own email”

1) Do not reply, click on links, or open attachments. Responding confirms that your mailbox is active and can facilitate future attacks. Paying only fuels the blackmail without resolving anything.

2) Delete or mark the message as spam. This will help improve your provider's filters and reduce the appearance of similar campaigns.

3) Strengthen the security of your accounts: change your password to a strong, unique one, and activate two-step verification. If you use the same password on multiple platforms, change it on all of them to avoid previous breaches.

4) Review recent logins and activity on your primary accounts. If you don't detect any suspicious access, it's probably impersonation without actual intrusion.

5) If you have already made payments or provided data, gather evidence (screenshots, transactions, messages) and report it to the authorities, such as the Police or Civil Guard. Do not engage in further communication with the attacker and save all evidence of the extortion attempt.

How to report, filter, and block based on your service

Gmail: Mark as phishing/spam and block

In Gmail, you can report a message as spam or phishing and block the sender to avoid future unwanted emails. When an email is moved to Spam, Google receives a copy to improve overall detection.

• Mark as spam on the web: select the message, click on the “!” icon, or use Shift+1; Gmail will confirm the action.
• On mobile: Select the message, tap the three dots, and choose "Report as spam." You can also use the app on Android or iOS.
• Block sender: Open the email, tap “More” (three dots) and select “Block”. Optionally, also mark as spam.
• Filters: in Settings > Filters and blocked addresses > Create filter. Define rules to manage or exclude certain emails.

Outlook/Hotmail: Manage spam and block senders

• Mark as “Spam”: select the message and click on “Spam”. You can decide whether to report this to Microsoft or not; the email will be moved to your spam folder.
• Block sender: In the message, click “Spam” and then “Block Sender.” To reverse the block, go to Tools > Junk Preferences.
• Improve spam filters: in Settings > See all settings > Mail > Junk mail. Enable options to block suspicious links, attachments, or images.

Apple Mail and iCloud

• From iPhone/iPad: Open the email, tap the flag, and select “Move to Junk.” You can block contacts from Settings > Mail > Blocked.
• On Mac: Select the message and tap “Junk Mail” or drag it to the appropriate folder. Set up filters in Preferences > Spam.
• On iCloud.com: Open the message and tap the flag, then “Move to Junk” or drag it to that folder.

Thunderbird

• Activate anti-spam controls: Menu > Options > Account Settings > “Spam Settings”. Check “Activate controls"

Good practices to reduce spam and avoid falling into traps

Think before you share your email and avoid posting it on open sites or forums, where bots and spammers can collect it. Use aliases or disposable accounts for untrusted registrations.

Do not interact with suspicious messages: do not open files, click on links, or unsubscribe from suspicious emails, This confirms that your email address is active and could exacerbate the problem. For legitimate newsletters, yes, you can unsubscribe at any time.

Keep your system, browser and applications updated, and use an antivirus with web and email protection, to prevent the download of malicious files and entry to fraudulent sites.

Activate two-step authentication on your main services, so that even if a password is leaked, they can't access it without your second factor of security.

If you handle a lot of mail, consider installing an additional spam filter, that provides a second layer of protection against unwanted messages.

How to know if your data or passwords have been revealed

Check if your email accounts or passwords have been released in public leaks, using trusted sites like haveibeenpwned.comIf you detect exposure, change the affected passwords and enable MFA.

If you believe that sensitive content with your name is circulating on websites or networks, search for your information and, if you find material that violates your privacy, requests its removal from the platform. In the European Union, you have the right to be forgotten and can request such withdrawal when appropriate.

Verification of communications from grassroots organizations

Some companies have implemented anti-fraud measures, such as verification codes on their official websites. If you receive a suspicious email from a parcel company requesting payment or data, validate the information on their official website or contact customer service.

Remember: Trustworthy organizations do not ask for credentials, bank details, or executable files via email or SMS, And if you're not expecting a delivery, the safest thing to do is ignore and delete that suspicious message.

How to better identify spam with these practical tips

Please check the sender's full address, not just the name that appears in the visible field, to detect unusual domains or those that do not correspond to the declared entity.

Be wary of messages with an “URGENT” or “immediate action” tone, as well as generic messages like “Dear Customer.” Legitimate messages generally use your name and display a more formal tone.

Pay attention to spelling or punctuation errors, and unnatural sentences, which are usually machine translation signals or automated templates.

Be very careful with unknown attachments or shortened links. Hover over the links to check the destination, or copy and analyze the URL in a reputation tool without clicking from the message.

Common case: “They write to me from my email and even reply to me.”

Users with Outlook or Hotmail accounts have received emails that appear to be from “Pegasus” or extortion schemes demanding cryptocurrency, And surprisingly, some people actually reply to those answers, even though they don't necessarily have control of the account.

If you have two-step verification enabled and your activity log doesn't show any successful logins, It is a sign that they have not been able to access your account. It's best not to reply, mark as spam, strengthen your password, and keep MFA active. Additionally, an updated antivirus adds protection against potentially malicious files.

Why email allows these scams and how the client protects you

The SMTP protocol, used for sending emails, was designed without strong sender authentication, allowing a malicious sender to set an arbitrary “From:” address that servers accept and forward.

At each hop between servers, the body of the message is recorded in the “Received”: of the technical header, facilitating the tracing of the original source for forensic analysis or impersonation detection.

Modern clients, such as Outlook, display visual alerts when they do not confirm the sender's identity, for example, a question mark or differences in addresses, to help us identify falsified senders.

When and how to escalate the problem

If you receive credible threats, specific details about you, or extortion attempts involving cryptocurrency, saves all evidence (headers, captures and transactions) and report to the security forces.

Also report the incident to your email provider and the impersonated institution (bank, courier, etc.), providing all the collected documentation.

The key to protecting yourself is to recognize phishing, ignore blackmail, and activate the appropriate defense mechanisms: mark as spam, block senders, verify headers, strengthen passwords, maintain MFA, and use antivirus. If you want to continue learning about practices like this to avoid falling for it, we recommend reading other articles, such as this one about How to remove malware from my cell phone.