Received mail from friend's hacked hotmail account - advice?

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Not quite a Newb Joined: 09 Jun 2011 Posts: 37

My friend's hotmail account was hacked two days ago. The hacker sent a message out to everyone pretending to be my friend, sending the following message:

Quote:

I'm writing this with tears in my eyes,my family and I came down here to Madrid Spain for a short vacation unfortunately we were mugged at the park of the hotel where we stayed,all cash,credit card and cell were stolen off us but luckily for us we still have our passports with us.

We've been to the embassy and the Police here but they're not helping issues at all and our flight leaves in less than 3hrs from now but we're having problems settling the hotel bills and the hotel manager won't let us leave until we settle the bills,i'm freaked out at the moment.

And later, another message:

Quote:

The hotel name is sector hotel and here is the hotel manger number +36634140350,I'm so glad you guys replied back,I have nothing left on me right now and I was lucky to have my Life and passport with me it would have been worst if they had made away with my passports.Well i need a quick favor from you,,I was wondering if you can lend me £1,580, so that i can sort the hotel bills and get a cab to the Airport,,,you can have it wired to my name via Western Union or Money Gram I'll have to show my passport as ID to pick it up here,you have my word and i can make it up to you, I promise to pay you back as soon as I get back home. Here's my info below

Name...(my friend's name)
Location...avenida de la plaza torrros 67,28025 Madrid
Spain

As soon as it has been done, kindly get back to me with the MTCN Confirmation number.
I owe you a Lot

The hacker has changed the password and the security questions, and my friend is locked out of her account. She has filled out the online forms for hotmail, and I and others have sent the message to hotmail abuse, yet the account remains open and the hacker is continuing to send messages requesting money. Hotmail as of yet has taken no action nor has even provided any reply to my friend.

This has caused major problems for my friend -- she has had to cancel her credit cards just in case there was some information on her hotmail account that would have compromised them. She is traveling next month, so cancelling her credit cards now is causing major inconveniences, to say the least.

From what I've read on the Internet, this unfortunately seems to be a rather common occurrence.

I'd like to ask for advice or assistance in doing one or more of the following: 1) scambait the hacker 2) attempt to get the hacker to surrender the account or even hack back into the account to regain control (I realize this is a longshot).

I would appreciate any advice or assistance that you might have. My friend is at her wit's end, and I'm trying to help as much as I can.

Thank you.[/quote]

Posted: Thu Jun 09, 2011 8:18 am

Tell her to keep contacting Hotmail's abuse department.
Eventually, they will answer.

If she can prove it's her account, they may be able to return it to her. Make sure you send them a copy of that email with full headers.
If they still won't return it, ask them to kill it.

Not quite a Newb Joined: 09 Jun 2011 Posts: 37

Thanks for your advice. She's filled out the online form for account recovery several times, and I've sent hotmail abuse the e-mail with the full headers several times as well. There has been no response whatsoever, and it has been almost 3 full days.

Posted: Thu Jun 09, 2011 8:45 am

3 days is nothing where hotmail are concerned. Although they say they answer in 24 hours, it's not unusual to wait for more than a week.

Tell your friend to keep trying. She's got to do it, not you. They won't take any notice of you because you're not the account holder.

She should also leave a post here: http://www.windowslivehelp.com/forums.aspx?productid=1

Posted: Thu Jun 09, 2011 8:59 am

Just thinking aloud:
Your friend might consider setting up a fresh email account and mail her contacts to warn them. Confused

Not quite a Newb Joined: 09 Jun 2011 Posts: 37

Thanks... yes, she posted something on her Facebook page warning everyone. Now the scammer is apparently attempting to hack into her Facebook account... she is repeatedly getting new password requests from someone in Nigeria.

Posted: Thu Jun 09, 2011 2:38 pm

While your friend is waiting for Hotmail to get their act together, why don't you make the best of a bad situation? Go ahead and bait the scammer.

Tell him you're so sorry about his plight and that you'd be happy to send him some money. Of course, there is no Western Union near you, just Moneygram. Then give him a bogus 8-digit Moneygram number. When he whines that it's wrong, apologize profusely and say that you read it wrong. The number is actually... and give him a slightly different one.

It's great fun!

Posted: Thu Jun 09, 2011 4:43 pm

A mass bait on this boy could be constructive - Flood him with offers of cash and Moneygrams, and drive hiom to despair while the vic gets in touch with anyone who is on sending-money terms with her to let them know the situation. Insant poison maga.

Opinions from the hive?

In the meantime get her to change her facebook details to a completely unrelated email account and a password consisting of dozens of alphanumeric characters. This will make it impossible to guess.

Most email accounts I've seen compromised by hostiles have had passwords guessed rather than hacked. It's like picking locks .... these skills are pretty rare in the real world.

Posted: Thu Jun 09, 2011 4:54 pm

mass bait sounds fun to me, i have lots of chinese spam to forward Twisted Evil

Has the hacker actually changed the password?? also get her to change EVERY password she uses online, to a strong password, move sensitive stuff to another email client aswell. Dont want laddo getting at her bank accounts

Posted: Fri Jun 10, 2011 4:15 am

As fun as a massbait sounds, the scammer has information on the friend, the real account owner, and will connect any bait attempts to the real person--this would not be baiting safely.

Master of Master Baiters Joined: 26 Sep 2008 Posts: 689

Another point to consider ... from your friends hotmail account how many other online sites could your friend have with the same password? Hacking Facebook is one thing, hacking your bank account is another ... and then there's identity fraud ...

Passwords ... mix upper case and lower case letters, use numbers in the mix .... avoid real words and where possible use none printable characters BUT MOST IMPORTANTLY keep it safe, keep it SECRET! If you need a copy of it put it in a text file and save it on a memory stick that you keep with you at all times.

Watch out for dodgy emails asking you to verify your details ... by logging in with your password (classic example - "your online bank account has been suspended due to irregular transactions yada yada please log in to verfiy")

Not quite a Newb Joined: 09 Jun 2011 Posts: 37

Thanks to everyone for these replies. So far I have just done some very basic baiting similar to what was suggested above -- insisting on Moneygram, giving a number, making a mistake, giving a fake receipt, etc. I've also created two different fake accounts to do similar things. My friend has read some of my correspondence with the scammer and she has found it quite entertaining, and a good stress reliever given what this scammer has made her go through. However, the point made about his having access to her personal information is a good point. I don't know if what personal information she has stored in that account, so I don't know what the scammer has access to, but the scammer at least knows her name and knows her Facebook account (as the scammer is now trying to hack into that as well). The point about her having the same passwords on other online accounts in a good point as well. She has changed her Facebook password and she has cancelled her credit cards just in case there was any credit card information contained in the hacked account, but I will warn her about this as well.

I must say though that I am quite surprised that hotmail hasn't responded to her at all. One would think that hotmail would not want a scammer using someone else's account to commit wire fraud...

Thanks again for all your comments!

Not quite a Newb Joined: 09 Jun 2011 Posts: 37

The scammer is now asking for money to be sent to another name and location in the UK:

Quote:

NAME..............Phyllis Murphy
ADDRESS...........14 Evesham Street,
CITY................London
ZIP CODE.........W11 4AR
COUNTRY.........United Kingdom

My friend is a British national, and she went to the British consulate (she doesn't live in the UK) to alert them, as there were some people who were concerned upon receiving the message and called the embassy or consulate. She also wanted to alert them to the fact that the scammer was now requesting funds be sent to a London address. No one there aside from the receptionist would even talk to her.

Posted: Fri Jun 10, 2011 8:56 am

I know it's easy to be clever in hindsight but you may want to give your friend a quick lesson about phishing.

In most cases scammers gain access to email and FB accounts etc because the owner has not realised that they've responded to a phishing email that looks genuine.So I would guess that there's a better than 90% chance that your friend unwittingly gave her details away.

It can take a lot of time and effort to hack someones email account but only takes a few minutes in the internet cafe to send out a few hundred phishing emails and the scammer only needs a very low percentage of the receivers not to realise the email's a scam in order to be in business.

Posted: Fri Jun 10, 2011 2:27 pm

N N N I like the idea of putting the info on a memory stick, but I just went looking for the memory stick I have and dang, can't remember where I put it! I do keep all my p/w's in a little telephone directory book which I can always find.

Posted: Fri Jun 10, 2011 3:10 pm

delamancha wrote:

She also wanted to alert them to the fact that the scammer was now requesting funds be sent to a London address. No one there aside from the receptionist would even talk to her.

The address means absolutely nothing. The payment can be picked up anywhere in the World as long as the scammer knows the details.
It's very, very doubtful that the money is going to be drawn in the UK.

Not quite a Newb Joined: 09 Jun 2011 Posts: 37

Slightlyoutofit wrote:

The address means absolutely nothing. The payment can be picked up anywhere in the World as long as the scammer knows the details. It's very, very doubtful that the money is going to be drawn in the UK.

I didn't realize that, and I don't think my friend did either. So one can make up any address in the world and collect it from a different location?

Not quite a Newb Joined: 09 Jun 2011 Posts: 37

woodyuk wrote:

I know it's easy to be clever in hindsight but you may want to give your friend a quick lesson about phishing.

In most cases scammers gain access to email and FB accounts etc because the owner has not realised that they've responded to a phishing email that looks genuine.So I would guess that there's a better than 90% chance that your friend unwittingly gave her details away.

It can take a lot of time and effort to hack someones email account but only takes a few minutes in the internet cafe to send out a few hundred phishing emails and the scammer only needs a very low percentage of the receivers not to realise the email's a scam in order to be in business.

My friend doesn't recall doing such a thing, but she did bring her computer to the shop just a few days before this happened, so we suspect that this is connected to the hacking, but of course she has no proof.

Posted: Fri Jun 10, 2011 4:23 pm

delamancha wrote:

So one can make up any address in the world and collect it from a different location?

Basically, if you're a half decent scammer - yes.

Posted: Fri Jun 10, 2011 10:16 pm

in case we are asked to go to infight with this scammer just drop us the address Wink

Posted: Sat Jun 11, 2011 4:24 am

Do not bait from your real life email address! That is not safe baiting and may get your own box hijacked.

Bucky wrote:

While your friend is waiting for Hotmail to get their act together, why don't you make the best of a bad situation? Go ahead and bait the scammer.

Tell him you're so sorry about his plight and that you'd be happy to send him some money. Of course, there is no Western Union near you, just Moneygram. Then give him a bogus 8-digit Moneygram number. When he whines that it's wrong, apologize profusely and say that you read it wrong. The number is actually... and give him a slightly different one.

It's great fun!

Not quite a Newb Joined: 09 Jun 2011 Posts: 37

Just an update:

-- Hotmail has STILL not responded, and the scammer is STILL using her hotmail address.
-- My friend has also been locked out of Facebook account AND her new gmail account that she set up after getting her hotmail account hacked. The scammer had been sending multiple password requests to Facebook for her account before she got shut out, so it's not clear if the scammer has hacked into her accounts or if they have just blocked her out because of too many password requests. Her life is really turned upside down now.
-- I set up three fake e-mail accounts and I am doing basic baiting, such as providing fake numbers, fake receipts, asking for forms to be filled out, etc. The scammer does not appear to be very smart. The scammer even accidentally sent one of my replies through one fake account to me in another fake account, and it's obvious the scammer got confused.

I really don't know what to do now to help my friend. She doesn't have that much computer knowledge, so I'm trying to help her as much as I can, but at this point I don't know what I can do other than just baiting the scammer and wasting the scammer's time as much as possible, which seems to be pretty easy to do. Any suggestions would be most welcome.

Thanks to all for your helpful replies.

Sex-starved Tikka Masala Joined: 04 Mar 2011 Posts: 259

Maybe if some other baiters get involved and mass-bait this lad, he'll get extra confused and won't have the time to scam any of your friend's RL contacts. Not sure if you want to do this with your friends personal account though.

Not quite a Newb Joined: 09 Jun 2011 Posts: 37

Baitsamurai wrote:

in case we are asked to go to infight with this scammer just drop us the address Wink

Sorry, what does "go to infight" mean?

Sex-starved Tikka Masala Joined: 04 Mar 2011 Posts: 259

I think he means "bait the hell out of this bastard". I'm sure a bunch of folks here would be on board.

Received mail from friend's hacked hotmail account - advice?	View next topic View previous topic