# Is there a “how to” about Gmail fraud, updated at least once per week?

My Gmail account has just been cracked and many of my contacts are receiving fake emails, claiming that I'm in troubles and requesting money.

Searching for advice, using Google, about what actions are to be undertaken, I've found stereotyped and generic suggestions about "good habits", and developed a feeling for them.
But there don't seem to be "contingency specific" guidelines and forensic tutelage. (For example, if someone really sends money, could he arrange that I should reimburse him? Or, even worse, what if criminal use is made of my account ... ?)

Is there a "how to" about current phishing threats on Gmail, that is updated at least once per week?

• Asking for off-site resources is usually off-topic on Stack Exchange. But the real question seems to be, "What should I do when my personal e-mail account is compromised." – S.L. Barth Feb 18 '15 at 14:52
• what actions are to be undertaken Consider using 2 step authentication next time. – Kshitiz Sharma Feb 18 '15 at 15:00

## 1 Answer

Remember we are security experts and can't give legal advice:

• Most likely it's impossible to figure out how exactly your account was compromised.
• Let Gmail team know that it happened, they may be able to help.
• Unfortunately, the best you can do for your friends is to let them know you were compromised. If this happened at work, let your IT people know immediately.
• Generally, people are not held accountable for the actions of E-mail hijackers as obviously some fraud has occurred. But take a grain of salt with that statement because I'm a hacker, not a lawyer.
• In the future make good decisions about how you use your mail. Use a good password, never give it out, keep your browser and other tools up to date etc... it sounds like you've already had a lot of that kind of advice.

Forensics?

To be honest, since you don't control the mail server, you don't have much room to research on this one. It would be a different matter entirely if this had been your own mail server. However, in this case you only have the info Google let's you have. If you want, you can look at the logs described here:

https://support.google.com/mail/answer/45938?hl=en

Perhaps you will get lucky and find a clue. However, in most cases even if you find the attackers identity, there is literally nothing you can do.

As for analyzing the actual E-mails, they are usually pretty generic. If they are being used for phishing you can analyze the linked malware, but again it is often fairly generic. The kind you buy on cheap hacker forums and send to thousands of people, you know?

If you are not a reverse engineer already, I wouldn't suggest it as a first step. Reverse engineering malware is a specialty all its own.

Final Advice

Report it. Reset your password. Make sure you are clean. Move on. Try and live a safer internet life. Life is too short to realize that you're e-mail hijacker used tor, lives in a foreign country, and will most likely never be brought to justice even if you were to prove his crimes to the proper authorities.

• I'm very grateful for your learned and open answer. The only consolation is that a money request is, all in all, a rough scam ... – mitochondrial Feb 18 '15 at 18:37
• Not much you can do but e-mail your entire contact list and warn them. Happens to the best of us. – baordog Feb 18 '15 at 20:45