Not Wi-Fi, But... How To Tell If Your Email Has Been Hacked (It Probably Hasn't)

A friend of mine recently posted a message on Twitter telling people that his email had been hacked.  

I told him that his email had most likely NOT been hacked, and it took all of thirty seconds to figure that out.  

A lot of people believe that their email has been hacked when they receive messages like this:

From: A Friend
To: Me
Subject: Has your email been hacked?

Body: [Forwarded message from "You" that you didn't actually send.]

When someone receives an email from "You" that you didn't send, it could mean that your email is hacked, but it probably doesn't.

Here's how to check:

Ask your friend to click or tap on Your Name (the "From" in the email).

If your real email address shows up, then the email was sent from your real email account.  That means your email has been hacked.

If an email address that is NOT yours shows up when your friend clicks/taps on Your Name (in the "From" field of the email), then the email was sent from an email account that is not yours.  That means your email has NOT been hacked.

Here's an example:

I received this email a while back, ostensibly from Michael Kedor, who is a long time friend:

When I clicked on Mr. Kedor's name, this is what I see:

My friend Michael does NOT use the email address "lars@surfzandvoort.nl".  He's not even Dutch (though he was into surfing when he lived in SoCal).

That means that my friend Michael's email was NOT hacked.

***

I keep reading that Millennials always want to know the "Why?", and I consider myself nothing if not Millennial-friendly...  Therefore, I'll answer the hypothetical question, "Why is my friend receiving an email from 'me' if my email hasn't been hacked?"

The reason, as best I can tell, is that someone is monitoring your friend's social media activity, and they are TRYING to hack your friend's email via a "spear-phishing" attack.  (NOTE: This is NOT a sign that your friend's email has been hacked.)

In my case, someone probably saw that I am Facebook friends with Michael Kedor, and that we often interact on Facebook.  At the time I received the email shown above, I had not yet set my Facebook to "Friends Only", which is a setting I STRONGLY recommend and which can be set like so:

Click the little down arrow on the far top/right of the Facebook screen, and go to "Settings"...

...then on the left side of the page select "Privacy"...

...and in the middle of the page, click/tap "Edit" in the line for "Who can see your future posts?"...

...from there you'll be able to select "Friends" as the people who can see your Facebook posts...

...and you can also click/tap that "Limit Past Posts" link if you're worried about hackers trying a spear-phishing attack using your past posts.

***

The way spear-phishing works is that a hacker looks at your public Facebook (or other social media) posts, identifies a friend that you commonly interact with, then sends you (or your friend) an email that APPEARS to come from them.

The hack becomes successful if either your friend OR you click the link that is included in the hacker's email.  (This is why I always tell I.T. people: STOP MAKING YOUR USERS CLICK LINKS)

Remember, getting one of these emails (or having a friend get one of these emails) does NOT mean that your email (or your friend's email) has been hacked.

***

And how does this relate to Wi-Fi?

If you connect to public Wi-Fi networks, it is trivial for a hacker to deliver one of these phony emails via Wi-Fi, without leaving the typical Internet "footprint" that comes with most spear-phishing attempts.

***

In summation, check the email ADDRESS of friends who send you emails, and don't panic if your friend asks you if your email has been hacked.  Chances are your email has NOT been hacked, and the suspicious email is just an ATTEMPT at spear-phishing.

******

If you like my blog, you can support it by shopping through my Amazon link or becoming a Patron on Patreon.  Thank you.

Twitter: @Ben_SniffWiFi

ben at sniffwifi dot com