Gmail Bounce Emails I Never Sent: Spoofed or Hacked?

Your Gmail inbox fills up with messages that say, for example, "Delivery Status Notification" or "Undeliverable" (the wording varies). They are replies to emails you never sent, to people you do not know. Or a stranger writes back about a message you have no memory of. The first fear is that someone has got into your account.

This guide follows Google's own help pages. It sets out how to tell a spoofed address from a hacked account, what to check in what order and what to do for each case. We do not promise a diagnosis from a distance, and no outside service can read your mailbox from a distance. A wrong step, such as replying to the bounces or clicking links in them, can make things worse, so know what you are doing before you start.

Last checked: 26 October 2026.

#What Does Spoofing Mean for a Gmail Address?

Google's Someone is sending emails from a spoofed address page says your Gmail account might be spoofed if you get bounce messages for emails that look like they were sent from your account, or if you get a reply to a message you never sent.

The page explains that when you send an email, a sender name is attached to the message, and that the sender name can be forged. When spoofing happens, your address can be used as the sender address or the reply-to address. It says some spammers use software to create random lists of email addresses for spoofing. If a spammer spoofs your Gmail address, you might get reports of delivery failures for emails that look like they were sent by you.

On what to do, the page says that because these emails are created outside Gmail, Gmail is not able to stop the spammers from spoofing your address, and that if you get these emails you should report them as spam. So a spoof is not an intrusion into your mailbox. It is someone borrowing your address.

#Spoofed or Hacked: What Points Which Way?

The two Google pages describe different signs. Compare what you see against the table. Treat it as a guide and not a verdict, because the pages do not say how to be certain.

Put plainly, bounces alone fit the spoofing page. Evidence in your own account, such as Sent emails you did not write or settings you did not change, fits the hacked-account page. Both can be true at once, so check the account before you relax.

#How Do I Check My Gmail Account Step by Step?

Google's Secure a hacked or compromised Google Account page gives the checks. Start with the ones that cost nothing and change nothing.

1. Open the Sent folder. Look for emails you did not write. The hacked-account page lists Sent Emails that you did not write as a sign.
2. Go to your Google Account, then Security, and open Recent security events. Select No, it wasn't me for anything you do not recognise, and follow the steps on the screen.
3. Open Your devices, then Manage devices. Check for any device you do not recognise. If you find one, select Don't recognise a device and follow the steps on the screen.
4. Check Gmail settings, using the list on the page: mail delegation, automatic mail forwarding, scheduled emails, your name in Gmail, the vacation responder, the address on outgoing mail, blocked addresses, IMAP or POP access, filters and labels. Correct any unfamiliar change immediately.
5. Look at Last account activity, described below.

Google's Last account activity page says you can see your sign-in history in Gmail by clicking Details at the bottom right, including the dates and times the account was used and the IP addresses involved. It says you can see the last 10 IP addresses and approximate locations, and that a warning about suspicious activity may show up to 3 additional IP addresses labelled suspicious.

The page also lists harmless reasons for several locations, such as using POP or IMAP in another mail app, Mail Fetcher showing a Google IP, or a phone carrier showing a location far from you. It says that if you do not recognise the activity, someone might have access through phishing or malware, and that you should change your password immediately.

#What Should I Check About Forwarding and Filters?

Forwarding is the quiet sign. Google's forwarding page says that if you set up forwarding you get a notice in the first week, and that if you see a forwarding notice but never set it up, you should change your password immediately, because someone else might have access, and turn off forwarding in Gmail settings.

On a computer, the forwarding page says to open Gmail, click Settings, then See all settings, then the Forwarding and POP/IMAP tab, and check the Forwarding section. If you did not add the address, click Disable forwarding and save changes. The page also says a filter can forward specific messages, so open the Filters tab too.

#What to Do If It Looks Like Spoofing Only

1. Do not reply to the bounce messages and do not click links or open attachments in them.
2. Report them as spam. Google's report spam page says to select the emails and click Report spam at the top.
3. Run the checks above once, so you know the account itself is clean.
4. Keep an eye out for a change. If friends start telling you they received spam from you, Google's spoofing page points to the Gmail security checklist and to reporting the problem to Gmail.

Google's Report spam in Gmail page also says that for a message with a spoofed-address warning, you should not reply or open links until you can verify the address, and that Google will not ask for personal information over email. That matters, because people who see odd emails are a target for fake security alerts. Our guide on real or fake Google security alert emails shows how to check one.

#What to Do If It Looks Like a Hack

The hacked-account page says that if you cannot sign in, you should go to the account recovery page and answer the questions as best you can. It uses that route if someone changed your account information, deleted your account or you cannot sign in for another reason.

If you can sign in, it says to change your password immediately for your Google Account and for apps and sites that use the same password, then check for and remove unfamiliar devices. It also says to turn on 2-Step Verification, to remove labels, filters or forwarding rules you did not set up, and to contact your bank or local authorities if banking or identity details are saved in the account. Our guide to Gmail recovery after a hack goes further.

If the bounces carried phishing links, or you clicked one, read our guide on what to do after clicking a phishing link.

#What the Pages Do Not Say

The pages we read do not say how to be certain whether you are a spoof victim or a hack victim, and they do not give a time limit for either case. They do not say why a particular spammer chose your address, and they do not say the bounces will stop after you report them. They do not promise that Gmail can block a spoof. We do not know your case, and we will not guess it.

#When It Is Safer to Get Expert Help

Some people sort this out alone, and the official steps stay first. The risks are plain. A spoof can look like a hack, and a hack can hide behind a flood of spoof bounces. If you change the wrong setting, or follow a link in a fake alert, you can lock yourself out or hand the account over. Google says it will not ask for personal information over email, so any message that does is a warning sign. People who offer to trace the sender or recover the mailbox are not using a route Google describes. Our guide to spotting fake recovery services lists the signs.

If you are unsure about any step, or the mailbox matters for your income or business, handing the case to an experienced team such as AwareXone is the safer choice. We can help you work through the checks in order and secure the account. We never ask for your password. See our account security help page, and use the Apply for Case Review button at the end of this guide.

#When a Case Review Makes Sense

If the Sent folder shows emails you did not write, or settings changed, or the mailbox is tied to your business or other accounts, a review can help you decide what to do first. SocialSafe by AwareXone is a Malaysia-based service, independent of Google, that helps you use the official routes. We never ask for your password or login codes, and we cannot change Google's decisions. See how we work on our trust page.

#Frequently Asked Questions

Short answers, based on the Google pages we read on 26 October 2026.