Can You Trust an Email From a Familiar Sender? How to Spot Compromised Email Accounts

An email from a familiar sender can still be a scam. Learn how compromised email accounts are used, the warning signs, and how to verify a suspicious email safely.

Can an email from someone you know be a scam?

Imagine this: an email arrives from a colleague you have worked with for years, a supplier you pay every month, or a friend you message regularly. The sender address is one you recognize, the message lands in the same conversation thread you have used before, and the request seems ordinary — open a shared document, confirm a detail, or pay an invoice. Nothing about it looks suspicious, so you almost act on it.

This is exactly the situation a compromised email account is built to exploit. A familiar sender name or an existing email conversation does not automatically prove that a message is safe. Legitimate email accounts can be taken over by someone else and used to send fraudulent messages that appear to come from a genuine person or organization. Because the message truly originates from the real address, it can be far more convincing than an email sent from an unfamiliar or lookalike address.

So, can you trust an email from a familiar sender? Not on the basis of the sender alone. A known address raises your confidence, but it does not verify that the person behind the account is the one sending the message, or that the request inside it is genuine. This article explains how compromised email accounts are used in scams, the subtle warning signs to watch for, and how to verify an unexpected request from someone you know before you click, share information, or send money. For a broader checklist of email warning signs, see our guide on how to tell if an email is a scam.

What is a compromised email account?

A compromised email account is a genuine email account that an unauthorized person has gained access to. The attacker logs in using stolen credentials, a leaked password, a phishing page, or a hijacked session, and then uses the account as if they were the owner. From the outside, the account looks completely normal — same address, same display name, same conversation history.

What makes a compromised account dangerous is that the attacker can send messages that genuinely come from the real address. The recipient sees a familiar sender, the email provider sees a legitimate login, and the message passes the technical checks that exist to stop spoofing. The Federal Trade Commission warns that scammers use compromised accounts and impersonation to make fraudulent messages appear trustworthy.

It is important to distinguish a compromised account from two other tactics that look similar but work differently:

• Sender spoofing changes the visible From address so a message appears to come from someone else, but the message does not actually pass through the real account. Spoofing can often be detected by checking the underlying authentication results. For a deeper look, see our guide on what a spoofed email address is.
• A lookalike address uses a domain that is close but not identical to the real one — for example, replacing a lowercase l with a capital I, or adding a hyphen. The message comes from a separate address the attacker controls, not the real account.
• A compromised account is different from both: the message truly comes from the real address, because the attacker is inside the account itself. This is the hardest of the three to detect by looking at the sender alone.

How scammers abuse familiar and compromised email accounts

Once an attacker controls a real email account, they can use it in several ways. Each tactic relies on the trust the recipient already places in the sender.

Sending fraudulent requests from a real person's account. The attacker sends a message that looks like it comes from a colleague, manager, or supplier, asking the recipient to do something — approve a payment, share a file, or confirm account details. Because the address is genuine, the recipient's instinct is to trust it. The FBI describes business email compromise as schemes in which criminals compromise email accounts to redirect payments or steal sensitive information.

Taking over an ongoing conversation. Rather than starting a new message, the attacker replies within an existing email thread between two people who already trust each other. A malicious link, attachment, or changed payment instruction is inserted into a conversation the recipient has no reason to doubt. This is sometimes called conversation hijacking, and it is especially effective because the surrounding context is genuine.

Impersonating a colleague, manager, supplier, or business partner. Using the compromised account, the attacker borrows the real person's identity and relationship with the recipient. A message from a manager asking for a quick favor, or from a supplier confirming a delivery, carries the weight of an established relationship.

Requesting an urgent invoice payment or a change to bank details. One of the highest-value patterns is a message claiming the supplier's bank details have changed, or that an invoice must be paid urgently to a new account. The request looks routine, but the new account belongs to the attacker. The FBI notes that these requests often target businesses that regularly make international or wire transfers.

Asking for passwords, verification codes, or confidential information. The attacker may request login credentials, a one-time code, sensitive documents, or access to a system, framed as a routine task. Because the request comes from a known address, the recipient is less likely to question it.

Distributing fraudulent messages to the victim's contacts. A compromised account is also a distribution channel. The attacker can send scam messages to everyone in the victim's address book, borrowing the victim's credibility to reach new targets who would otherwise ignore a stranger.

The following examples are fictional illustrations of these patterns. They do not describe real incidents, contain working phishing links, or provide instructions that could help someone commit fraud.

Example 1: A supplier's bank details change mid-conversation

A small business receives a reply inside an existing email thread with a long-time supplier. The message says the supplier has changed banks and asks that the next invoice be paid to a new account number. The address is the supplier's real address, the tone matches previous messages, and the request seems routine. The new account, however, belongs to an attacker who has taken over the supplier's account.

Example 2: A manager asks for a discreet favor

An employee receives an email from their manager's real address asking whether they are available, then a follow-up requesting they purchase gift cards or process a payment quietly before the end of the day. The urgency and the request for secrecy are designed to stop the employee from verifying through normal channels.

Example 3: A shared document in a trusted thread

A reply appears in an ongoing conversation between two colleagues. It contains a link to a shared document and asks the recipient to sign in to view it. The link leads to a credential-harvesting page. Because the message sits inside a trusted thread, the recipient is far more likely to click than they would be for an unexpected link from a stranger.

Example 4: A friend's account sends a request for money

A person receives a message from a friend's email address asking for help with an urgent situation — a stranded traveler, a locked account, a medical bill — and a request to send money or buy gift cards. The friend's account has been taken over, and the attacker is using the existing relationship to lower the recipient's guard.

Warning signs that an email from a familiar sender may be unsafe

Because a compromised account sends from the real address, the usual checks — does the domain match, is the display name correct — will pass. The warning signs are subtler and sit in the request itself and how it is framed.

• An unexpected request for money, gift cards, bank transfers, or payment-detail changes. A sudden change to how a supplier is paid, or a request for gift cards from a colleague, is one of the strongest signals of account takeover.
• A sudden change in the sender's tone, writing style, or usual habits. If a normally formal colleague writes in a rushed, informal way, or a supplier's messages suddenly contain different phrasing, it is worth a second look.
• Unusual urgency, secrecy, or pressure to bypass normal procedures. Requests to keep a transaction private, skip a sign-off, or act within hours are designed to isolate you from the people who would catch the fraud.
• Unexpected links, attachments, shared documents, or login requests. A link or file that appears in a trusted thread without an obvious reason, especially one that asks you to sign in, can be a delivery method for malware or credential theft.
• Requests for passwords, authentication codes, or confidential information. No legitimate colleague, supplier, or organization needs your password or one-time code by email. A request for either is a strong warning sign.
• A message that seems out of character for the sender. Even when the address is familiar, a request that does not fit the sender's role or your relationship with them deserves scrutiny.
• A request that does not fit the sender's usual responsibilities. A manager asking an employee to handle a personal payment, or a supplier asking for login credentials, falls outside normal expectations.
• A suspicious request inserted into an otherwise legitimate conversation. When a single unusual message appears inside a trusted thread, the surrounding genuine context can mask the fraud.

These are warning signs, not definitive proof. A person's writing style can change naturally, and some legitimate messages are genuinely unusual. The goal is to notice when several signs appear together, especially around money, credentials, or changes to established procedures.

Does a familiar sender address prove an email is genuine?

No. A familiar sender address tells you where the message came from, but it does not tell you who is controlling the account or whether the request is legitimate.

There are three things that are easy to confuse: the display name, the visible email address, and evidence that the account or message is trustworthy. The display name is decorative and can be set to anything. The visible email address is more meaningful, but a compromised account sends from the genuine address, so even checking the address after the @ is not enough on its own.

Email authentication — SPF, DKIM, and DMARC — helps with parts of this problem, but it does not solve it. At a high level, SPF checks which servers are allowed to send mail for a domain, DKIM cryptographically signs message content, and DMARC ties the two together and tells receivers what to do on failure. These checks are designed to stop spoofing and forged sender addresses.

What they cannot do is prove that the person sending the message is the account owner, or that the request inside it is legitimate. A message sent from a compromised real account passes every authentication check, because it truly came from that account. The Cybersecurity and Infrastructure Security Agency advises treating unsolicited messages that push you to act through an unfamiliar channel as potential phishing, regardless of who they appear to be from.

In short, a message can pass authentication checks and still be fraudulent. Authentication answers the question of where a message came from, not whether you should act on it. For a deeper look at how authentication results can be misleading, see our guide on why email headers lie, and for the limits of what email security checks can catch, see our guide on whether a scam email can pass an email security check.

How to verify a suspicious email from someone you know

When a message from a familiar sender feels off, verify before you act. The following checklist works for any unexpected request, but it is especially important when money, credentials, or changes to procedures are involved.

1. Pause before clicking links, opening attachments, or responding to unusual requests. The single most effective step is to slow down. Urgency is a tool scammers rely on.
2. Review the complete sender address and the context of the message. Confirm the address is the one you expect, and consider whether the request fits the sender's usual role and your relationship with them.
3. Examine unexpected payment instructions, requests for sensitive information, or changes to established procedures carefully. A change to bank details or a request for credentials is the highest-risk type of request and deserves the most scrutiny.
4. Contact the sender using a separate, previously trusted channel. Call a known phone number, use an established messaging conversation, or speak in person — anything other than replying to the email itself.
5. For payment-detail changes, independently verify the request using an established contact method and existing approval procedures. Call the supplier on a number you already have on file, not one in the email, and follow your organization's normal sign-off process.
6. Navigate to relevant websites or services independently. Type the address yourself or use a bookmark instead of following an unexpected link in the email.
7. Do not share passwords, verification codes, or sensitive information in response to an unexpected request. No legitimate sender needs these by email.
8. If the sender's account may be compromised, warn the sender through another trusted channel. Letting the person know their account is sending suspicious messages helps them recover it and protect their other contacts.
9. If the message remains suspicious, do not interact with it until its legitimacy has been established. It is safer to delay a legitimate request than to act on a fraudulent one.

Why not just reply to the email to ask whether it is genuine? Because if the account has been taken over, the attacker controlling it will also receive your reply and can reassure you that everything is fine. Replying to the suspicious email is not a reliable verification method for exactly this reason. Always verify through a separate channel you already trust. For a broader walkthrough of verifying a sender safely, see our guide on how to check if a suspicious email is really from a company.

What to do if you suspect someone's email account has been compromised

If you believe an account has been taken over, the right response depends on whether you are the recipient or the account owner. Keep the advice proportionate — a single suspicious message does not always mean an account has been hacked.

If you received the suspicious message

• Avoid clicking links, opening attachments, or completing requested transactions. Do not act on the request until it has been verified.
• Contact the sender independently. Use a phone number or channel you already trust, not anything in the email.
• Report the message to your email provider or organization where appropriate. Most providers have a report-phishing option, and your workplace security team should be told if a business account is involved.
• Notify relevant workplace security staff if the message involves a business account or confidential information. They can contain the incident and warn colleagues who may receive similar messages.

If your own account may be compromised

• Use the provider's official recovery process to secure the account. Google and Microsoft both publish official guidance on recovering a hacked or compromised Google Account and how to recover a compromised Microsoft account.
• Change the password from a trusted device. Use a device you are confident is clean, and change the password anywhere you reused it.
• Enable multifactor authentication. A second factor makes it far harder for an attacker to regain access, even if they have your password.
• Review active sessions, recovery details, forwarding rules, and connected applications. Attackers often add a forwarding rule that silently sends copies of your mail to an address they control, or a recovery email that lets them retake the account. Remove anything you do not recognize.
• Contact the provider's support team if access cannot be restored. If you are locked out, the provider's account-recovery process is the route back in.
• Warn your contacts about suspicious messages sent from the compromised account. Letting people know helps them avoid acting on fraudulent messages sent in your name.

Not every suspicious email means an account has been hacked. A message can be spoofed, sent from a lookalike address, or simply unusual without the account itself being compromised. The steps above apply when you have reason to believe the real account is involved.

Can an email scam checker identify a message from a compromised account?

An email scam checker can help, but it has real limits when the message comes from a compromised account. Understanding what it can and cannot do keeps you from over-relying on it.

An email scam checker analyzes the message content you provide and looks for suspicious indicators: urgency language, requests for credentials or payment details, mismatched or lookalike links, impersonation patterns, and other warning signs. It can summarize those signals into a risk score and list the specific red flags it found, which helps you decide whether to act.

Its limitations matter as much as its capabilities:

• A message from a compromised account may look completely normal. Because it comes from the real address and may be written to mimic the sender's usual style, it can contain few obvious scam markers.
• The tool may not know whether the sender's account has actually been taken over. It analyzes the content you provide; it does not have access to the sender's account or login records.
• Results depend on the information provided and the specific checks the tool performs. A short or vague message gives the checker less to work with.
• A message flagged as suspicious is not automatically proven fraudulent. A flag is a reason to verify, not a verdict.
• A message assessed as low risk is not guaranteed to be safe. A low score means few suspicious markers were detected, not that the request is legitimate.

Scamlify's Email Scam Checker performs AI-based analysis of the message content. It does not detect account takeovers, verify account ownership, access private email-provider records, or inspect authentication headers. For SPF, DKIM, and DMARC checks, use the Email Header Analyzer with the raw message headers. The scam checker is one layer of analysis that complements your own judgment and independent verification, not a replacement for either.

Use Scamlify's Email Scam Checker

When an email from a familiar sender feels off, one practical step is to analyze a suspicious email with Scamlify's Email Scam Checker. You paste the email body, message text, or a link, and the tool returns a 0–100 risk score, the warning signs it found, any suspicious URLs, what personal or financial information the message requests, and recommended next actions. The text is parsed in memory for a single request and never stored or logged.

Review the results alongside the context of the message — who the sender is, whether the request fits your relationship with them, and whether anything feels unusual. The checker is an additional precaution, not a substitute for independently verifying unusual requests from familiar contacts. When money, credentials, or changes to procedures are involved, always confirm through a separate channel you already trust before acting.

One important caution about privacy: do not submit passwords, authentication codes, full card numbers, confidential business correspondence, or sensitive personal information to an online tool. Review the tool's privacy information before submitting content. For most checks, the message text without sensitive details is enough for an assessment.

Frequently asked questions

Can someone send a scam email from a real email account?

Yes. When an email account is compromised, an attacker can send messages from the genuine address, and those messages pass the technical checks designed to stop spoofing because they truly originate from the real account. This is why a familiar sender address alone does not prove a message is safe. The request inside the message, not the address it came from, is what you need to verify.

How can I tell if a friend's email account has been hacked?

Look for a request that seems out of character — a sudden ask for money or gift cards, a link or attachment with no clear reason, unusual urgency or secrecy, or a change in writing style. None of these alone is definitive proof, but several together are a strong reason to verify through a separate channel you already trust, such as a known phone number. If you cannot reach your friend through another channel, treat the message as suspect until you can.

Can a compromised email account pass spam and authentication checks?

Yes. SPF, DKIM, and DMARC are designed to stop spoofed and forged sender addresses, not to detect when a real account has been taken over. A message sent from a compromised account passes these checks because it genuinely comes from the real address and server. Authentication tells a receiver where a message came from, not whether the person controlling the account is the legitimate owner or whether the request is safe to act on.

Should I trust an email just because it comes from a familiar address?

No. A familiar address raises your confidence, but it does not verify who is sending the message or whether the request is genuine. A compromised account sends from the real address, so the sender check passes even when the message is fraudulent. Trust the request only after you have verified it through a separate, previously trusted channel, especially when it involves money, credentials, or a change to established procedures.

How do I verify a payment request from a colleague or supplier?

Do not act on the request as it appears in the email. Contact the colleague or supplier using a phone number or contact method you already have on file — never one provided in the message — and confirm the request and any new bank details directly. Follow your organization's normal approval procedures for payment changes. If you cannot verify the request independently, do not send the payment until you can.

What should I do if I receive a suspicious email from someone I know?

Do not click links, open attachments, share information, or complete the requested transaction. Contact the sender through a separate channel you already trust to confirm they sent it. If the account may be compromised, warn the sender through that other channel so they can secure it. Report the message through your email provider's report-phishing option or your workplace security team, especially if a business account or confidential information is involved.

Can an email scam checker identify a compromised account?

Not directly. An email scam checker analyzes the content of the message you provide and can flag suspicious wording, unusual requests, or manipulative language, but it cannot determine whether the sender's account has been taken over, verify account ownership, or access the sender's private account records. A message from a compromised account may look completely normal and produce few warning signs. Use a checker as one source of evidence alongside independent verification, not as a way to confirm or rule out account takeover.

What should I do if I clicked a link in an email from a compromised account?

Close the page immediately and do not enter any information. If you typed a password, change it on the genuine service and enable multifactor authentication. If you entered payment details, contact your bank or card issuer straight away. If you shared a one-time code, tell the relevant provider at once, because code-relay scams move in under a minute. If it happened at work, contact your IT or security team. For a full recovery walkthrough, see our guide on what to do if you clicked a phishing link.

• Check a suspicious email
• More Scamlify cybersecurity research
• Security suite