0

I have a gmail account [email protected] and I am sending emails to a lawyer with corporate email (I don't know the software they use). I am sending monthly bills to the lawyer for consulting fees.

Last week, this lawyer was fooled by receiving an email from [email protected] (note the difference in spelling) with one of my invoices attached, asking when payment would be sent. This person signed my real name, and asked that payment be sent via ACH. The lawyer was fooled and responded saying payment would be made next week. It was only by luck that he mentioned this to me in person and I told him I had sent no such emails.

I now surmise that:

  • Someone has access to lawyer's name, lawyer's email address, my name, my email address, and an invoice of mine
  • Seems likely that the attacker has access to either my gmail or the lawyer's email (I don't think it's possible Google was hacked)
  • I access gmail with my Mac Air Laptop, Windows Desktop, Android phone
  • I use two-fac on gmail, so it's doubtful someone has my password and logged in remotely

If I am the one compromised, how would I know? The only thing I can think of is that I have malware on one of my three devices that's allowing access to my gmail through a backdoor. Is there any other likely scenario?

And the main question: what can I do or should I do to stop this from happening again?

Improve this question

2 Answers 2

Reset to default
2

While there are technical measures to protect your email account, the biggest issue is that your lawyer accepted a change in payment processes without verification. It should not have happened regardless of who was hacked or when.

In Business Email Compromise (BEC), the most effective defense is to have processes in place that will block this type of problem before it happens. No changes to payments, billing or invoicing should be made without confirmation.

What has happened is a crime worthy of reporting to both the bank and to law enforcement, which I encourage you to do.

Improve this answer
0

I'm not sure you can do something that guarantee you a 100% prevention, I think such a thing does simply not exist.

But I would suggest you to start by securing your gmail account.

1- Check, Re-Check and Re-Re-Check your Gmail settings

2- Verify your backup-codes Backup codes can be used to sign in without knowing your security key / password. Try to generate new ones to revoke the previous

3- Password and two-step security I suggest you to change your current password and the phone # you used for the two-step auth.

4- Verify your account activities - regularly

You can see your sign-in history, including the dates and times that your Gmail account was used. You can also see the IP addresses which were used to access your account.

You can also use Google Authenticator which is:

A software token that implements two-step verification services using the Time-based One-time Password Algorithm and HMAC-based One-time Password algorithm, for authenticating users of mobile applications by Google

I think you can also check your home router if everything is fine and avoid using public hotspot especially for this kind of exchanges.

Improve this answer
2
  • The details of the situation as described don't really indicate that the gmail account of OP was compromised (though it would be good to look into google account security events history to check for logins from new devices), it seems much more likely to be a compromise on the lawyer's end or of one of OPs workstations, so this advice is nice to do but won't really solve their problem.
    – Peteris
    Feb 22, 2019 at 12:33
  • I'm aware of this and I think nobody can really answer his question !
    – Soufiane Tahiri
    Feb 22, 2019 at 13:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .