Bounce messages for email you never sent can result from someone forging your Gmail address. That alone does not prove they signed in to your account. Check account activity and mailbox changes separately so you can distinguish address spoofing from actual unauthorized access.
Inspect the evidence without opening suspicious links
Note whether you received a delivery failure, a reply from a stranger, or a message showing your own address as the sender. The From or Reply-to address can be forged outside Gmail.
Check Sent mail, but do not treat an empty Sent search as complete proof of safety. Review your Google Account security through a trusted route, including recent activity and authorized access.
Look for signs of account access
- Review devices and security events you do not recognize.
- Check Gmail forwarding destinations, delegates, filters, and Send mail as entries.
- Look for rules that hide or delete security notices.
- Ask affected contacts for original-message evidence through a safe channel if needed.
Unknown access or unauthorized settings justify securing the account immediately. Change an exposed password, review recovery options and verification methods, and remove unauthorized access using Google’s official process.
Handle spoofing and compromise differently
If the evidence points to forged messages created elsewhere, report the unwanted bounces or deceptive mail appropriately. Google explains that Gmail cannot stop every outside sender from placing your address in a forged sender field.
Do not reply to the attacker, send identification to an emailed recovery service, or assume that changing your password alone prevents external address forgery. For a managed domain, its administrator can investigate authentication and domain policy; those controls differ from a personal Gmail recipient setting.
If contacts received real spam from your account or you find unfamiliar activity, treat that as a potential compromise and follow the account-security checklist. Preserve relevant timestamps and redacted evidence. Avoid telling contacts that everything is safe solely because one message was marked Spam or one authentication result looked favorable.
Browse Gmail & Google Account help
References
- Someone is sending emails from a spoofed address
- Gmail security tips
- Trace an email with its full header
Reviewed against the linked product guidance, standards, and identified vendor or public-authority guidance on October 29, 2026. Available options and screen labels can vary by account, device, region, and organization policy.