Has my email been compromised? And if so, how do I fix it?

Hungerdunger

In the last couple of weeks, two friends have reported receiving emails with my name on asking them to click on a URL.

I asked them to forward the emails to me and these are the details from the original emails:

From: Richard Thompson <chong02@students.poly.edu>

Sent: 28 May 2020 19:41
To: you
Subject: Fwd: Note from Richard Thompson
 On Thursday, May 28, 2020 12:34 PM, Richard Thompson wrote:
Is there any chance you know this couple http://wwwdotwcp6dotseoixpiadotinfo/

----Original Message-----
From: Richard Thompson
Sent: Friday, May 22, 2020 7:01 PM
To: you
Subject: FWD: for Richard Thompson
On Friday, May 22, 2020 11:54 AM, Richard Thompson wrote:

Any chance that you could know them both http://wwwdotprj4doteurretodotinfo/

(I've replaced . with "dot" to avoid anyone accidentally clicking on the URL.)  The email address in the header of the first one is NOT mine. 

Can anyone with better technical knowledge than me explain what might be going on, and what might happen if someone was to click on the link? What action should I be taking?

I use Gmail on four devices - desktop PC, laptop PC, Android phone and and Android tablet.  I have McAfee total protection on the PCs but nothing on the others.

Neil_Jones

If in doubt change your passwords and set up two factor authentication.

Far more likely that these have just been spoofed.

forgotmyname

So the actual email received was not from your email account, just had your name and maybe spoofed email. 

Sender changed the FROM to be your email address. Puzzles me why most email software prefers the FROM option rather than
showing the true senders ID.

So MrBobScratchit@SCAMYOU.LOTS changes his FROM to be your name and your friends see your name and not his real email,
if they look in the email header info they will probably see his real sender ID.

chrisw

They are spoofs but somehow they must have got hold of your contacts list. The chances of two of your friends randomly receiving an email from a Richard Thompson are slight.

All you can do is change the passwords, add 2 factor authentication and let your contacts know to be wary should they receive a similar email purporting to be from you.

JJ_Egan

I get them from a dead persons account .

Judged by the format at some time the dead persons emails to me and others where hijacked .

But most likely is the old email mistake of sending something to every contact and not using BCC ,

Result is all get all the contacts the mail is sent to . Worst still some of those emails may be forwarded on to others .

Not a problem as i set a message rule to delete any with the words  john.nobody .

grumpycrab

Change password and add 2FA.  If you don't know what 2FA is lookit up. I've known people be defrauded because they didn't know a third party had got into their email accounts (that's what 2FA guards against).  AND many people don't even realise that they have an email password. AND when they do realise they've either forgotten it or created a really simple one.  Rant over.

And people should be taught at an early age that if an email contains words similar to "Any chance that you could know them both http://wwwdotprj4doteurretodotinfo/"  that they should ignore it.  What happens if you click the link?  That's a good test of your computer's security.  If your're really interested, get Virus Total to have a look at it for you
https://www.virustotal.com/gui/home/url

Hungerdunger

Thanks to everyone for their replies.

I installed two factor authentication sometime  last year, and I changed my password as soon as I became aware  of the problem.

Grumpycrab - I tried out the URLs in VirusTotal, and they both came back "clean", but I'm still not going to take any chances!!

[Deleted User]

If you want to know if your email has been leaked you could try haveibeenpwned.com (or whatever the proper name is), it shows if an email address is in a data breach.

tronator

chrisw said:

They are spoofs but somehow they must have got hold of your contacts list. The chances of two of your friends randomly receiving an email from a Richard Thompson are slight.

And even more likely is, that a third person, who had them both in his address book, got hacked and now sends these emails without knowing it.