Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Lost $10k as my email was hacked. Any ways to recover it?

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 88 posts

Re: Ask HN: Lost $10k as my email was hacked. Any ways to recover it?

#61

Post by xoa »

Alex3917 wrote: post #55
xoa wrote: post #49

Earlier quoted context omitted.

Amusingly in a thread on email scams and such you didn't read quite closely enough (plus OP didn't do a great job of differentiating either, maybe on purpose) :). Even ignoring the "sent from your domain = contract" assertion: > Now on the next day my client received an email from "abicde@mydomain.com" stating that there is a change in invoice and revised invoice is again sent which had bank account details of a UK b…

> Notice the "i", different from abcde@mydomain.com The username on the domain doesn't matter, only the domain itself.

>The username on the domain doesn't matter, only the domain itself.

Of course it matters if it means that it wasn't actually sent from the domain in the first place and there were no "hacks" involved. You said "emails sent from your domain..." but you do know the "From" address in standard email is utterly meaningless from a security perspective right? You can just

  sendmail -f any.address@example.com any.target@example2.com
and that's it. There are ways to mitigate that these days and someone can always examine the headers of something suspicious but a lot of older desktop clients and mailservers won't.

Your entire (dubious and uncited) assertion rests on an assumption that it was in fact "sent from their domain". If someone forged it instead then it doesn't even get into law at all, OP simply had nothing to do with it period. Their account wouldn't have been hacked, neither they nor their kit would have any involvement.

Re: Ask HN: Lost $10k as my email was hacked. Any ways to recover it?

#62

Post by shripadk »

milanmot wrote: post #22
rnotaro wrote: post #18

Earlier quoted context omitted.

Do you recognize this domain? > authenticated_id: shahrukh@makamil.com

No. This is some unknown email address.

https://b2bpk.com/company/ma-kamil-pharma-57113.html

Weird that the domain points to another Pharma company operating from Karachi, Pakistan. Maybe contacting them to find out who "Shahrukh" is might be a good first step.

EDIT: Looks like 0898 found more details https://news.ycombinator.com/item?id=18310807

Re: Ask HN: Lost $10k as my email was hacked. Any ways to recover it?

#63

Post by czbond »

vemv wrote: post #51
czbond wrote: post #6

This is very common issue; I've personally helped a company after they lost much more than this, and had to help prove to insurance/govt agencies/etc. Turn on DKIM, DMARC, and SPF records for your mail domain. Also, never send invoices over email that contain any payment terms (eg: accounts, addresses to mail check to, etc) they should always be in some sort of protected portal. Tell every customer never to accept pa…

Not sure if a portal is any better. Can't an email point to a fake portal?

Absolutely it could. However, with a secured portal - the client would know to go there, rather than email for many interactions already. Once DKIM,SPF,DMARC are on - the spoofed email is harder to do. In this particular case, I'd suggest giving them a file of contact information, and not ever publishing it (email, etc). Also, in my view, it is much easier to spoof emails, than to attack a proper web app.

Re: Ask HN: Lost $10k as my email was hacked. Any ways to recover it?

#64

Post by czbond »

milanmot wrote: post #10
czbond wrote: post #6

This is very common issue; I've personally helped a company after they lost much more than this, and had to help prove to insurance/govt agencies/etc. Turn on DKIM, DMARC, and SPF records for your mail domain. Also, never send invoices over email that contain any payment terms (eg: accounts, addresses to mail check to, etc) they should always be in some sort of protected portal. Tell every customer never to accept pa…

Is there anyway to recover that money?

Highly unlikely - but also, a side fact to keep it from happening again. The attack similar to this I had to help address, someone had sent an email to a client, over an Indian shared office space network. That network was found compromised, and man-in-the-middled. Suggest doing business communications like email over VPN (F-secure VPN or simlar) only.

Re: Ask HN: Lost $10k as my email was hacked. Any ways to recover it?

#65

Post by moviuro »

runako wrote: post #50
moviuro wrote: post #3

Banking standards here in the EU impose a 13 months period during which the sender (order sender) can ask for a full refund. Check your local rules. This has to be talked about with the respective banks involved (that of your client + the one that received payment), as I believe you can't do anything anymore. Next time, use more than one communication channel (Facebook, phone, signal, telegram, whatsapp... anything,…

> Banking standards here in the EU impose a 13 months period during which the sender (order sender) can ask for a full refund Is this really true? Do EU bank transactions really take 13 months to fully clear?

No, they don't take 13 months to clear. The idea is to protect the payer (the one losing money) from either their human error, or an unlawful debit.

See https://www.europeanpaymentscouncil.eu/what-we-do/sepa-direc... .

Re: Ask HN: Lost $10k as my email was hacked. Any ways to recover it?

#66

Post by Alex3917 »

xoa wrote: post #61
Alex3917 wrote: post #55

Earlier quoted context omitted.

> Notice the "i", different from abcde@mydomain.com The username on the domain doesn't matter, only the domain itself.

> The username on the domain doesn't matter, only the domain itself. Of course it matters if it means that it wasn't actually sent from the domain in the first place and there were no "hacks" involved. You said "emails sent from your domain..." but you do know the "From" address in standard email is utterly meaningless from a security perspective right? You can just sendmail -f any.address@example.com any.target@exam…

> but you do know the "From" address in standard email is utterly meaningless from a security perspective right?

That would be the argument as to why the domain owner would have a duty of care when also using the domain to send legitimate business email. Again I'm not saying there is a duty of care here, I'm just saying that it's not obvious to me that there isn't one.

Re: Ask HN: Lost $10k as my email was hacked. Any ways to recover it?

#67

Post by jiveturkey »

one important thing you didn't state, was this $10k order typical for them, or especially outsized. another important thing, you didn't state how any discussion to date has already gone with the client.

anyway, no matter, you are in india, the client/customer is in canada? the amount is only $10,000 and you are a "very" small company? you have no practical recourse.

i'd even give small odds that the client is in fact scamming you.

regardless, good luck but in the face of an uncooperative client, you're out of luck.

many of the arguments here are around legal correctness, who is at fault, etc. but they fail to take into account that you are too small and the amount is too small and across international borders, for you to do anything about it. now if the amount were $100,000 you'd be able to pursue it.

Re: Ask HN: Lost $10k as my email was hacked. Any ways to recover it?

#68

Post by gus_massa »

shyn3 wrote: post #19

Your email did not get hacked most likely. Your client got tricked. They spoofed an email with your domain, but the reply-to email was their own (the attacker). So the client thinks they responded to you, but they responded to the fake address. Also, generally when they do this, they spoof the body and the conversation of the email. Most likely, your client's emails were compromised in this case. Ask them to forward…

I agree. A few (10? 20?) years ago it was very easy to spoof email and send an email "from" mickey@disney.com if you wish. The original email specification has almost no security features. Now, most of the email servers will sign the outgoing email, and if you receive an email with the signature gmail and others big webmail providers will show a big warning.

So, to understand the problem it is very important to get a copy of all the complete emails with all the hidden headers that have the automatic signatures of the servers the email passed through. (See https://www.google.com/search?q=email+headers )

With the emails headers it is posible to see if your server was hacked or if the sender field was spoofed.

Re: Ask HN: Lost $10k as my email was hacked. Any ways to recover it?

#69

Post by shyn3 »

samstave wrote: post #32
shyn3 wrote: post #19

Your email did not get hacked most likely. Your client got tricked. They spoofed an email with your domain, but the reply-to email was their own (the attacker). So the client thinks they responded to you, but they responded to the fake address. Also, generally when they do this, they spoof the body and the conversation of the email. Most likely, your client's emails were compromised in this case. Ask them to forward…

Or an employee of his used this information to email the client and steal the money

This is not limited to an employee at OPs organization. It can be an employee from the corporation he is doing business with. Alternatively, someone could have printed an old email and one of the facilities providers (i.e. cleaning crew) found it and used it.

Re: Ask HN: Lost $10k as my email was hacked. Any ways to recover it?

#70

Post by matt_the_bass »

Maybe this is a dumb question, but have you talked to your customer about this? Such issues are covered by insurance plans that are common for US companies. It may be as simple as your customer makes a police report and then provide it to their insurance. Then 60 days later they get a check and pay you.
Post reply on HN