Compromised hotmail account

flaneurs_lobster

Couple of things that may have been done with a compromised email account.

A mailing to any/all contacts that could be, at its simplest, a solicitation of money

Does your mother use online banking linked to this email account? You'd hope that the passwords are different but in any case email can be used to start reset of online access.

Ditto for control of mobile phone account.

Yorkie1

Thanks @flaneurs_lobster

Those people who have responded to the initial email have received one of the standard 'I have a friend whose daughter has cancer, can you send me Amazon vouchers' style email. So yes, email to all and solicitation of money.

Luckily she has no online banking.

After 50 minutes on the phone, we seem to have got her back into email on the iPad. It does look a little odd with outboxes numbered, but it's a start (or worse!!).

Will have to leave her iPhone until tomorrow. Neither she nor I have the appetite for going through the descriptions of what is on the page on a second device. Will keep an eye on what happens when the daily limit on sending emails has been reset tomorrow.

k_man

Has the rogue/unexplained Windows device now logged out/been removed?

Yorkie1

https://forums.moneysavingexpert.com/discussion/comment/82077008#Comment_82077008

Yes, just done it this evening. Hopefully that will help. It was an Inspiron 5420. I can't remember what my previous laptop was, so it was either my old device, or one we don't recognise.

I logged on to her account earlier today. The 4 messages in draft had disappeared overnight - they weren't in sent (and I didn't receive the ones to me), deleted, archive, etc.

I think there was further activity on the account at about 4am today.

The can't send / daily limit message is apparently a standard one from MSoft if they detect unusual account activity. Apparently it may take 24 - 72 hours to unblock.

Yorkie1

https://forums.moneysavingexpert.com/discussion/comment/82076872#Comment_82076872

Have deleted this Rule as well. It's not a standard Rule.

PRAISETHESUN

I'd still activate 2FA even if it causes her a bit of friction initially. After the initial login on her device there shouldn't be any need for the additional verification but it will prevent additional logins elsewhere