There are two possibilities, and they need different fixes. Either someone outside your business is forging your address on emails you never touched, which is spoofing, or someone has actually got into your mailbox, which is a compromise. Spoofing is a nuisance. A compromise is serious and needs acting on today.

How to tell which one you have

Sent items. If the emails other people are receiving are in your sent folder, someone sent them from inside your account. If not, it is spoofing.
Inbox rules. In Outlook, look under settings for rules. Attackers add rules that hide or delete replies, so the owner never sees people querying the odd request. A rule you did not create means a compromise.
Sign in activity. Microsoft 365 logs where your account was signed in from. Sign ins from countries you have never visited mean someone else has your password.

Also look at the actual sender address on a suspicious email, not just the name. If it shows a free address with your name on it, that is a third, milder problem covered below.

If it is spoofing

Email lets anyone write any address in the From field, much like a false return address on an envelope. What stops it is three records on your domain name called SPF, DKIM and DMARC. SPF lists the servers allowed to send for you, DKIM adds a digital signature to every genuine message, and DMARC tells the receiving server to reject anything that fails both checks.

Many small businesses have SPF only, or have DMARC set to monitor rather than reject, so forged emails still land in inboxes. Setting DMARC to reject is the fix. You do not need to change your password, because the attacker never had it.

If it is a lookalike address

If the fake emails come from a free address using your name, no record on your domain can stop it, because the attacker is not using your domain. Here the fix is people. Tell staff and regular customers that you will never ask for new bank details or an urgent payment by email, and that any such request should be confirmed by phone on a number they already have. Report the address to Scamwatch.

If it is a compromise

Treat this as a break in, because it is one. In order

Change the password from a device you trust and sign out of every session, which Microsoft 365 can do in one step.
Turn on multi factor authentication, where signing in needs a code from an app such as Microsoft Authenticator as well as the password. This stops it happening again.
Delete every inbox rule you did not create and check the forwarding settings for addresses you do not recognise.
Work out what the attacker could see. If the mailbox held customer details or anything personal, you may have a notifiable data breach under Australian privacy law and a duty to tell the people affected.
Warn everyone who received emails from the account while it was compromised.

What to do next

If you are unsure which problem you have, do not guess. The signs your business has been hacked page shows what a compromise looks like in more detail. For spoofing, an email health check confirms whether your SPF, DKIM and DMARC records are set correctly and fixes them if not. The sooner it is dealt with, the fewer people get caught.

Will changing my password stop the fake emails?
Only if your mailbox was compromised. If the emails are spoofed, the attacker never had your password. Fix the domain records instead.

Do I have to report it?
Spoofing on its own, no. A compromised mailbox that held personal information about customers or staff may need to be reported under the Notifiable Data Breaches scheme.

Can I find out who did it?
Rarely. Spoofed emails are sent from throwaway systems. Effort is better spent closing the gap than tracing the sender.

If this is happening in your business and you would like it sorted, call DM1 on (08) 6202 6012 or send us a message. We look after IT, Microsoft 365, websites and domain names for Perth small businesses.