Hackers Hijack Email Contacts

Have you received a rogue email from a friend or acquaintance that seems out of character?  For example:  Why is Aunt Mildred calling me “Friend” in her email?  Or, does neighbor Fred really want me to invest in Nigeria?

Odds are, their email accounts – particularly if located at online services like Gmail, Yahoo! Mail, or Windows Live Hotmail – have been hijacked.  (Visit About.com at About.com:Free Email Review for a review of the top 16 free email services by Heinz Tschabitscher.)

With an online service, the email application is cloud-based; the application does not reside locally on the computer, so it is probably the online account that has been compromised.  (Your PC could also be infected, which is discussed later.) Typically, the password is discovered, providing an easy entry to stored emails (which could contain sensitive information) and a contact list that can be exploited.

If this happens to you, login to your account and take these steps:

• Change your password – Use a complex password with at least eight upper and lower-case characters, numbers and special characters.  (Please See the January 2013 issue of Bryley Tips and Information for the article “Simple passwords = disaster” at Bryley-Tips-and-Information-January-2013
• Change your Recovery Information (challenge questions) – If the hacker has account access, he/she can retrieve your challenge questions.  Using these questions, he can then reenter the account after you change the password.
• Set the highest-possible level of security – Select the highest-possible level, even though it adds complexity to the login process.
• Check related accounts – You might have put passwords into saved emails that the hacker can now access.  Change your passwords and your Recovery Information on all other accounts that might have been compromised.
• Contact list – Email the folks in your Contact list and tell them:  “I am having an issue with my email account, which I am addressing.  Please contact me if you receive an unusual email that appears to have come from my email address.  Do not open any links within the email itself.”
• Backup emails and contacts – Backups allow recovery; backup your contacts whenever you add or change a contact.  Backup your emails as often as necessary to keep from losing stored emails.

As with any account, change your password regularly and change your challenge questions periodically.  Visit the About.com article on how to change your Gmail at About.com: Change Your Gmail Password.

For a related article by Leo Notenboom at Ask Leo, please visit Ask-Leo.com: How to stop someone sending email with my address.

If the email application reside locally and connects to a secure site, your PC would be suspect and should be interrogated by virus and malware scanners.  You should also scrutinize your Microsoft Outlook contacts and rename the Contacts folder.

It is still possible that your computer is infected; your account information might have been recovered through a keyboard logger that records your keystrokes and sends them to the hacker.  If so, you need to clean-up your computer before taking the steps above.