How to stop someone using my email address: sign-ups and spoofing

You can't stop someone from typing your email address into a form or into the "From" line of a message. Nobody can, including your email provider. What you can do is stop it from costing you anything: close or disown any account opened in your name, report spoofed mail as spam so filters learn it, make sure nobody is actually inside your account, and give new sites a separate address so your main one stops spreading.

The right steps depend on which problem you have. "Someone is using my email address" usually means one of three things, and each has a clear symptom.

Which problem do you have?

What you see	What's probably happening	Is your account at risk?
Welcome, verification or order emails for accounts you never opened	Someone typed your address into a sign-up form, by mistake or on purpose	Usually not, but the other account might be
Bounce messages or replies to emails you never sent, or mail in Spam that shows your own address as the sender	Spoofing: your address was forged as the sender	No
Messages in your Sent folder you didn't write, changed settings, or alerts about a sign-in	Someone has your password or a session	Yes

The first two are annoying but happen outside your account. The third is a break-in, and it comes first.

First, rule out a break-in

Before you treat this as spoofing, take two minutes to make sure nobody is actually in your mailbox:

Open your Sent folder. Spoofed mail never appears there, because it was never sent from your account. If you see messages you didn't write, someone has access.
Check your provider's list of signed-in devices and recent activity. Our guide on how to see who is logged into your email has the exact steps for Gmail, Outlook.com and Yahoo.
Look at forwarding addresses and filters for anything you didn't create.

If anything there isn't yours, stop here and follow our steps for a hacked email account. Google's advice for friends getting spam from you points the same way: run its Gmail security checklist and report the problem to Gmail (Gmail Help).

If everything is clean, keep reading.

If someone is signing up for things with your email address

This is the most common version. Sometimes it's a person with a similar address who keeps mistyping theirs. Sometimes it's someone who wants to bury your inbox in sign-up mail, or who's using your address so an account can't be traced to them.

1. Don't click the links in the email

A welcome email you didn't ask for may be real, or it may be a phishing email dressed up as one. Go to the site yourself, by typing its address or using its app, instead of using any link in the message.

2. Disown or take over the account

Many services send a verification email so the owner of the address can confirm the account. Ignoring it is often enough, because the account is never confirmed. If the site already treats the account as active:

Go to the site directly and use Forgot password with your email address. Because the reset goes to your inbox, you can take control of the account.
Once in, don't use the account for anything. Note what was set up in case you need to report it.
Delete the account from its settings, or contact the site's support and tell them the account was opened with your address without your permission.

If the account involves money, a credit application, or anything that uses your name and personal details, it's no longer just an email problem. Report it at IdentityTheft.gov, the FTC's site to "report identity theft and get a recovery plan."

3. Stop the leftover mail

For newsletters and promotions you were signed up for, use your mail app's own unsubscribe option rather than a link inside the message. In Gmail, open the email and click Unsubscribe next to the sender's name. Google notes that some senders require you to "go to their website" instead, and that it "may take a few days" for the mail to stop (Gmail Help). For anything that keeps coming, block the sender: in Gmail, after you block a sender, "all future emails from them go to Spam" (Gmail Help). Our guide to stopping spam emails has the same settings for Outlook, Yahoo and Apple Mail.

4. If it's a flood, report it

A sudden wave of hundreds of sign-up confirmations in a few minutes is often a deliberate attack, sometimes used to bury a real alert, such as a bank or shopping notice, among the noise. Report the messages as spam, then search your inbox for anything from your bank, your card issuer or online stores during that window, and check those accounts directly.

If someone is spoofing your email address

Email spoofing means forging the sender address on a message. Google explains it plainly: "the sender name can be forged. When spoofing happens, your address can be used as the sender address or the reply-to address" (Gmail Help).

You'll usually notice one of these:

Bounces for mail you didn't send. Google says some spammers "use software programs to create random lists of email addresses to use in spoofing," and if yours is picked, "you might get reports of delivery failures for emails that look like they were sent by you."
Mail in your Spam folder from "Me." Google says that if you see an email in Spam that replaces your address with "Me," "someone tried to put your address in the 'From' field of the message."
Replies to a message you never wrote.

What you can do about it

Be honest with yourself about the limits here. Google says that because these emails "are created outside of Gmail, Gmail isn't able to stop the spammers from spoofing your address." What it asks you to do is report them as spam.

Report every bounce and spoofed message as spam. In Gmail, select the emails and click Report spam. Google says that as you report more spam, "Gmail identifies similar emails as spam more efficiently" (Gmail Help). In Outlook.com, select the message and choose Report, then Report phishing. Microsoft notes that reporting "the sender is reported but is not blocked from sending you additional messages," so block the sender too if it keeps coming (Microsoft Support).
Don't reply to the bounces. They're automatic notices, and nobody reads replies to them.
Tell the people who matter. If friends, family or clients got a forged message, let them know it wasn't you and that you'll never ask for money, codes or passwords by email. Ask them to report it as spam rather than reply.
Report scams that used your name. If the forged messages were used to cheat someone out of money, the person who lost it can report it at ReportFraud.ftc.gov, the FTC's site for "reporting fraud, scams, and bad business practices." You can report it there too.

Spoofing runs often die down once the spammer moves on to other addresses. If you want to check where a particular message really came from, our guide on how to tell if an email is spoofed shows how to read the authentication results in the headers.

Why SPF, DKIM and DMARC won't fix this for a Gmail or Outlook address

You'll read that SPF, DKIM and DMARC stop spoofing. They do help, but only the owner of a domain can set them up. They're records published in the domain's DNS settings. Google's own guide for setting them up is written for Google Workspace administrators, and it describes SPF as helping "to prevent senders from impersonating you" and DMARC as letting you "choose what happens to messages that don't pass SPF or DKIM" (Google Workspace Admin Help).

If your address ends in @gmail.com, @outlook.com or @yahoo.com, that domain belongs to your provider, and those records are theirs to publish, not yours. There's nothing for you to set up, and any service that offers to "add DMARC" to a free personal address can't do it.

If you own your domain, for example you@yourname.com, you can. Set up SPF and DKIM for every service that sends mail for your domain, then add a DMARC record. Google recommends setting up both DKIM and SPF, and its DMARC guide says to wait 48 hours after SPF or DKIM before turning DMARC on. Once your DMARC policy is set to quarantine or reject, receiving servers that check it can send mail that forges your domain to spam or turn it away.

How to make your address harder to misuse

You can't take your address back from every list it's already on. You can slow its spread from here on:

Give sites a different address. Use an alias for sign-ups, shops and newsletters, and keep your main address for people and important accounts. If an alias starts getting junk or sign-ups you didn't make, delete it.
Keep your address off public pages. Google's phishing guidance says: "Don't post your contact info on public forums" (Gmail Help). Our guide on what someone can do with your email address explains what a public address exposes you to.
Protect the account itself. A unique password and a second factor mean that even if your address is everywhere, the inbox stays yours.

Frequently asked questions

Can I stop someone from using my email address completely?

No. Anyone can type your address into a form or a message header, and no provider can prevent that. What you control is the outcome: unconfirmed sign-ups go nowhere, reported spoofed mail is filtered, and a protected account can't be taken over.

Is it illegal for someone to use my email address?

It depends on what they do with it. A mistyped address is just a mistake. Using your address to commit fraud, steal your identity or harass you is a different matter. If it's gone that far, report it at IdentityTheft.gov or ReportFraud.ftc.gov, and contact local police if you feel threatened.

Why am I getting emails for accounts I didn't create?

Either someone mistyped their own address, or someone used yours on purpose. Don't click the links. Go to the site directly, reset the password if the account is active, then delete it or ask the site's support to remove it.

Someone sent an email from my address. Does that mean I was hacked?

Not necessarily. Check your Sent folder. If the message isn't there, it was most likely spoofed and never touched your account. If it is there, or you see other changes, treat it as a hacked account.

Should I change my email address?

Usually not. Spoofing and stray sign-ups happen to almost every address and tend to fade. A new address makes sense if the old one is buried in spam you can't control or was taken over and you no longer trust it. Our guide on changing your email address everywhere makes the move manageable.

Where Secria fits

The easiest way to keep your main address from being used is to stop handing it out. Secria Mail is free, and you sign up without a phone number or a card. Aliases (2 on free, 15 on Mail Plus, unlimited on Pro) give each site its own address that you can delete if it starts being misused. Every plan, free included, uses hybrid post-quantum encryption (ML-KEM-1024 with X25519) and zero-access storage, there are no ads, and tracking pixels are removed automatically and senders never see your IP address.

You can't stop someone typing your address, but you can make it pointless. Rule out a break-in first, take over or delete any account opened in your name, report spoofed mail as spam, and give the next site an alias instead of your real address.