The morning of March 2nd started out fairly normally. I moved quickly to get ready and jumped on my computer to check email, twitter, my feeds, etc. So I launched Outlook and happened to see an email from one of my good friends Matt Leonard. He’s a great guy and a smart marketer so we’re in touch often. The email was sent from Matt’s gmail account and the subject line communicated the urgency of his message.
Apparently, Matt flew to Nigeria the night before to attend the Tinapa Opening Ceremony. {???} He ended up staying at a hotel, which was attacked by armed robbers. {OK…} They took all of his money and his wallet. {???} His email explained that he needed money badly, to the tune of $1500 so he could settle his hotel bill. {LOL} He seemed very scared and he emphasized that he needed the money sent as soon as possible. As you can imagine, I was genuinely concerned for Matt… {sarcasm}
Yes, Matt’s gmail account had been hacked and I’m sure many people received the same email I did. Here was the original email:
———- Forwarded message ———-
Subject: *****URGENT REPLY NEEDED *********
Hello I am in a hurry writing this message, I had a trip to West Africa *NIGERIA* on visiting the TINAPA OPENING CEREMONY, Unfortunately for me all my money got stolen at the hotel where i lodged from the attack of some armed robbers.Right now,I’m without money and I’m even owing the hotel here, the hotel telephone service is disconnected,i have only access to emails,my mobile phone can’t work here so i didn’t bring it along, please can you lend me $1500 so i can return back and settle the hotel bills i would return it back to you as soon as i get home, I am so confused right now.You can have it sent through western union money transfer. My passport is with the Embassy here so i cant use my name to collect it now, But you can have it sent directly to a western union Manager here and i would get it through him as he helps the people here in the hotel to receive the money, I have already spoken to him, please let me hear from you so i can collect his full name and address where you can send the money tomorrow please,or if possible today. I am waiting for your reply.
Thank you. I look forward to your positive response.
Regards.
—————–
OK, this was absolutely ridiculous, but being the good friend I am, I still wanted to reach out to Matt as soon as possible to let him know what was going on. I was pretty confident he didn’t know yet. Now, I didn’t know if his actual account was taken over. I simply thought that someone was blasting out emails using his address as the sender. There’s a difference between the two. So, I created a new email (which was sent to his gmail account) informing him that his email address had been compromised. Unfortunately, that was the only email address I had for Matt…
It was a brief email that looked like this:
————————–
Hi Matt.
I just received a spam email from your gmail acct. Not sure if it’s
widespread or not, but wanted to let you know.
It was one of those Nigerian schemes.
Let me know if you have any questions.
Glenn
———————–
It was only a few minutes when I received an email back from Matt. My guess was that he wanted to quickly thank me for notifying him of the scam. I opened the email and was shocked to see that the original email from Matt wasn’t a joke! Matt was in fact in Nigeria at a hotel and needed money. {sarcasm yet again}
You see, “Matt” actually responded to my email!
Holy smokes, the scammers who hacked Matt’s gmail were answering emails right from his account! I’ll admit it, that creeped me out. Read their response to my email below:
———- Forwarded message ———-
Subject: Re: Email Spam
To: Glenn Gabe
Hello,
Its not a scam mail, i am really there now. i need you to help me with $1500, i shall pay you as soon as a i return. i hope to read from you asap. below is the info where the money will be sent to….
——————
So, I direct messaged Matt via Twitter notifying him of the hack, this time using only 140 characters or less. :) Before long, I received a DM back from Matt that he was handling the situation. He thanked me, and got back to fixing the problem. So, after Matt recovered his gmail account (and after he got pummeled by jokes on Twitter), I asked him about the steps he took to recover his gmail account.
After this happened to Matt, I asked myself if I would know what to do… I really didn’t. I’m sure I would eventually figure it out, but I didn’t know the exact steps. So with Matt’s assistance, I decided to write this post to document the steps you should take to recover your gmail account after it has been compromised.
So in Matt’s own words, here’s how to handle the situation:
The process was pretty simple.
First, from the Gmail login page, select “I can not access my account”.
Second, select the radio button “My account has been compromised”. This will show a new prompt below “Please fill out our account recovery form to help us process your request as quickly as possible”. Follow that link.
From the Account Recovery page, select “I believe someone has taken over my account” and fill out as much information as possible.
In my case, Google had contacted me pretty quickly via my alternate email with instructions to reset my password. {Glenn: Make sure your alternate email is active. You can check this from your Google account settings. You can also add additional email addresses just in case.}
Some other useful notes from Matt:
I’m not sure how someone hacked my gmail account. I did make a mistake by using the same password on way too many things. My main passwords are now individually unique. Passwords I set up for vendor accounts are no longer the same as I would use for other more sensitive services, like online banking.
Matt’s Tips to Protect to Your Logins:
1. Avoid unsecured networks
2. Don’t use the same password everywhere.
3. Don’t duplicate your email password with any login elsewhere (if you do, someone can use your email to login to your other accounts).
4. Change passwords periodically.
5. Don’t share your passwords with anyone. Even if they’re not going to abuse it, they may not store it properly.
6. Know where you enter passwords. 3rd party Twitter apps that require passwords are a perfect example of sites that people will enter their password without much familiarity aside from a tweet referral.
——————–
So there you have it. If you wake up one morning and everyone is asking how and why you checked into a Nigerian Hotel, forgot your wallet, ran up a $1500 bill, and now need money, you’ll know how to handle it. :) And definitely feel free to connect with Matt on Twitter. It’s ok to joke around with him about the situation. He’s a nice guy and has handled the jokes with grace. But don’t go too far, he can bench press 375 pounds and used to be a minor league hockey player. ;-)
GG
