A user's email is hacked, contacts copied, and similar emails (look alike emails with minor spelling differences) are created by the attacker with the same name and avatar, sending relatively well crafted and highly targeted emails to his contacts, mostly of the type "this is an emergency, send me some money now".
This happened to a friend months ago. He was able to retake his email, however the attacker is still very active. In one incident, the attacker was very close to convince my friends' bank account manager to transfer a hefty amount of money to a Western Union account in Thailand! The account manager called my friend because the money transfer details were missing one little information, and that is how it was stopped.
What's the best way to handle such a case?
Here's what I have and what I tried:
- Calling Yahoo to block impersonating emails - after a 25 minutes international call, they said they cannot help (?)
- The bank account manager email has a Western Union address, with name, address, and phone all in Thailand. What's the proper way of reporting this? does it help to do so?
- I have text-dump of the email headers -- I'm not an expert but wouldn't that include the attacker's IP? assuming this is correct, should I attempt to report this IP? to whom?
- In some of the emails, the attacker instructs recipients to go to a phishing website where they are asked to login using their email credentials. The website is hosted on free web hosting service 3gb.com
I can share all details (WU details, email dumps, website) in a paste bin if it is acceptable per SSE policy. The fraudster have been a major pain. Any suggestions are welcome.