Unless I am missing something I dont see a hack here, just some spoofed emails.
Very common and growing type of fraud sad to say
Ask HN: Lost $10k as my email was hacked. Any ways to recover it?
11–20 of 88 posts
Re: Ask HN: Lost $10k as my email was hacked. Any ways to recover it?
#12Unless I am missing something I dont see a hack here, just some spoofed emails.
It's not just a random spoof email. Someone was aware of the entire conversation and send a spoof email at the exact situation resulting in my loss.
Doesnt mean you were hacked could be an inside job by someone at either organization or could be a hack on the other company's email. If your email provider has any sort of activity log like gmail does you might want to review those, or if you run your own there should be access logs on the server.
Re: Ask HN: Lost $10k as my email was hacked. Any ways to recover it?
#13This is very common issue; I've personally helped a company after they lost much more than this, and had to help prove to insurance/govt agencies/etc. Turn on DKIM, DMARC, and SPF records for your mail domain. Also, never send invoices over email that contain any payment terms (eg: accounts, addresses to mail check to, etc) they should always be in some sort of protected portal. Tell every customer never to accept pa…
Is there anyway to recover that money?
Highly unlikely.
Re: Ask HN: Lost $10k as my email was hacked. Any ways to recover it?
#14I'm surprised I'm the first person to point this out, but you have not lost any money, your client has.
You sent the goods to the client, and they have yet to remit the payment to you. So they still owe you the money and you should insist they pay it.
Granted, they're not going to like that, but the reality is they sent payment due to you to some other person. That's something they did not something you did.
They may be in a position to take steps to recover the payment they sent to someone else, given the banks involved and so on, and they should try to do it. But that's not something you're really in a position to be involved in, you didn't have anything to do with it and aren't a party to the fraudulent transaction.
In the meantime they should return the goods or send you the payment they owe.
Re: Ask HN: Lost $10k as my email was hacked. Any ways to recover it?
#15Email headers of the fake email I received are below. Can anyone identify anything out it? ------- Received: (qmail 30963 invoked by uid 30297); 16 Oct 2018 19:04:18 -0000 Received: from unknown (HELO sg2plibsmtp01-1.prod.sin2.secureserver.net) ([182.50.144.11]) (envelope-sender ) by sg2plsmtp19-01-25.prod.sin2.secureserver.net (qmail-1.03) with SMTP for ; 16 Oct 2018 19:04:18 -0000 Received: from se1-lax1.servconfig…
Looks like it pretty transparently sends all replies to "dr.com". Seems like something our email client should warn us about explicitly, instead of just showing "Reply To: Kyle".
Re: Ask HN: Lost $10k as my email was hacked. Any ways to recover it?
#16If I'm reading your story correctly, it matches up with a tactic my clients have been seeing more lately. The scammer has already accessed your account because you fell for a phishing scam, typed your email credentials into a fake login site for a fake Office 365 or Dropbox page or something.
Now the scammers are watching your email closely waiting for the opportunity to do this. Waiting for you to send an invoice to your client, so they can jump in and send a revised invoice with their own payment details on it.
This can happen with intrusion into your email box, or your clients'. Hard to say exactly from your story. But either case, someone's mailbox was accessed by the intruder. A similar scam is possible by just using similar domain names, but in such a case you wouldn't know precise details of the invoices. You can just send a random fake invoice and hope the mark pays it or provides payment details in some way.
One thing worth noting in your story is that you aren't out $10,000. Your client is the one who paid the money to the wrong party. They are the ones who need to work with their banks and reverse the payment. It's not your fault that they paid the wrong person.
Re: Ask HN: Lost $10k as my email was hacked. Any ways to recover it?
#17Your client got defrauded, arguably through no fault of your own. They never paid you, so they still owe you. Good luck with this approach, though. IANAL
Edit: I see CPLX has said it much better than I in the meantime. Note that it’s not at all clear that the hack happened on your end, rather than your client’s (or perhaps at some intermediate ISP).
Re: Ask HN: Lost $10k as my email was hacked. Any ways to recover it?
#18Email headers of the fake email I received are below. Can anyone identify anything out it? ------- Received: (qmail 30963 invoked by uid 30297); 16 Oct 2018 19:04:18 -0000 Received: from unknown (HELO sg2plibsmtp01-1.prod.sin2.secureserver.net) ([182.50.144.11]) (envelope-sender ) by sg2plsmtp19-01-25.prod.sin2.secureserver.net (qmail-1.03) with SMTP for ; 16 Oct 2018 19:04:18 -0000 Received: from se1-lax1.servconfig…
Do you recognize this domain?
> authenticated_id: shahrukh@makamil.com
Re: Ask HN: Lost $10k as my email was hacked. Any ways to recover it?
#19Your email did not get hacked most likely. Your client got tricked. They spoofed an email with your domain, but the reply-to email was their own (the attacker). So the client thinks they responded to you, but they responded to the fake address. Also, generally when they do this, they spoof the body and the conversation of the email.
Most likely, your client's emails were compromised in this case. Ask them to forward you the original email received as an attachment, and the reply-email as an attachment.
Your client likely has to reach out to their banking institution. Most companies have safeguards against this on their end when sending money, specifically, when accounts change they get on the phone with someone using their Vendor list, not the communication from the email. Also, having multiple parties authorize a transfer.
Re: Ask HN: Lost $10k as my email was hacked. Any ways to recover it?
#20If I'm reading your story correctly, it matches up with a tactic my clients have been seeing more lately. The scammer has already accessed your account because you fell for a phishing scam, typed your email credentials into a fake login site for a fake Office 365 or Dropbox page or something. Now the scammers are watching your email closely waiting for the opportunity to do this. Waiting for you to send an invoice to…
> The scammer has already accessed your account because you fell for a phishing scam
> It's not your fault that they paid the wrong person.
How is this not the OP's fault? It's absolutely their fault - the fault that lead to their email being compromised