Ask HN: Lost $10k as my email was hacked. Any ways to recover it?

#1

Post by milanmot » Fri, Oct 26, 2018, 3:28 PM UTC

I have suffered a loss of $10k due to an extremely unbelievable case of my client's as well as my own email domain was hacked.

–----

So, I run a very small pharma export company in India. I have a client in Ontario, Canada with whom I have been doing regular business.

2 weeks ago I got an order worth $10000 from them. So as usual I dispatched the material to them and then raised the invoice with my bank details from my email address called "abcde@mydomain .com".

Now on the next day my client received an email from "abicde@mydomain.com" stating that there is a change in invoice and revised invoice is again sent which had bank account details of a UK bank account.

Now an email like "abicde@mydomain.com" doesn't exist at all.

My client asked me for a confirmation email again but this email never reached me. So the client made the payment and the money is already deducted from his account.

Also, what makes this even more strange is that I received a fake email from my client's company with 3-4 times about not asking for payment as it will be delayed.

I got this email from an email address like "klye@clientdomain.com" instead of "kyle@clientdomain.com".

Now $10000 in an extremely huge amount for survival of my company. I want to know what are my options and is there any way of recovering it.

Re: Ask HN: Lost $10k as my email was hacked. Any ways to recover it?

#2

Post by amorphous » Fri, Oct 26, 2018, 3:39 PM UTC

Immediately contact all the banks involved and report the fraud. They should be able to reverse the transaction.

Re: Ask HN: Lost $10k as my email was hacked. Any ways to recover it?

#3

Post by moviuro » Fri, Oct 26, 2018, 3:40 PM UTC

Banking standards here in the EU impose a 13 months period during which the sender (order sender) can ask for a full refund. Check your local rules. This has to be talked about with the respective banks involved (that of your client + the one that received payment), as I believe you can't do anything anymore.

Next time, use more than one communication channel (Facebook, phone, signal, telegram, whatsapp... anything, really)

You should also see with your domain registrar and mail provider what happened.

Re: Ask HN: Lost $10k as my email was hacked. Any ways to recover it?

#4

Post by milanmot » Fri, Oct 26, 2018, 3:44 PM UTC

moviuro wrote: post #3

Banking standards here in the EU impose a 13 months period during which the sender (order sender) can ask for a full refund. Check your local rules. This has to be talked about with the respective banks involved (that of your client + the one that received payment), as I believe you can't do anything anymore. Next time, use more than one communication channel (Facebook, phone, signal, telegram, whatsapp... anything,…

My domain and email provider is GoDaddy. Unfortunately, they said that they cannot do anything about it but still asked me to send IP email headers to their abuse team.

Re: Ask HN: Lost $10k as my email was hacked. Any ways to recover it?

#5

Post by milanmot » Fri, Oct 26, 2018, 3:50 PM UTC

Email headers of the fake email I received are below. Can anyone identify anything out it?

-------

Received: (qmail 30963 invoked by uid 30297); 16 Oct 2018 19:04:18 -0000

Received: from unknown (HELO sg2plibsmtp01-1.prod.sin2.secureserver.net) ([182.50.144.11])

          (envelope-sender )

          by sg2plsmtp19-01-25.prod.sin2.secureserver.net (qmail-1.03) with SMTP

          for ; 16 Oct 2018 19:04:18 -0000

Received: from se1-lax1.servconfig.com ([104.244.124.86])

               by bizsmtp with ESMTP

               id CUdcgdXtBUMdaCUdegyEaT; Tue, 16 Oct 2018 12:04:18 -0700

Received: from res203.servconfig.com ([192.145.239.44])

               by se1-lax1.servconfig.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)

               (Exim 4.89)

               (envelope-from )

               id 1gCUdY-0005Jd-Kn; Tue, 16 Oct 2018 15:04:16 -0400

Received: from [::1] (port=46403 helo=res203.servconfig.com)

               by res203.servconfig.com with esmtpa (Exim 4.91)

               (envelope-from )

               id 1gCUdY-00GWW5-7H; Tue, 16 Oct 2018 12:04:12 -0700

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="=_cb44418026f16861773c2073108229cd"

Date: Tue, 16 Oct 2018 12:04:12 -0700

From: Kyle

To: Reema

Cc: 'mail'

Subject: RE: pharma zonisamide

Reply-To: Kyle

Mail-Reply-To: Kyle

Message-ID:

X-Sender: Klye@clientname.com

User-Agent: Roundcube Webmail/1.3.3

X-Get-Message-Sender-Via: res203.servconfig.com: authenticated_id: shahrukh@makamil.com

X-Authenticated-Sender: res203.servconfig.com: shahrukh@makamil.com

X-Originating-IP: 192.145.239.44

X-SpamExperts-Domain: res203.servconfig.com

X-SpamExperts-Username: 192.145.239.44

Authentication-Results: servconfig.com; auth=pass smtp.auth=192.145.239.44@res203.servconfig.com

X-SpamExperts-Outgoing-Class: unsure

X-SpamExperts-Outgoing-Evidence: Combined (0.35)

X-Recommended-Action: accept

X-Filter-ID: EX5BVjFpneJeBchSMxfU5rwL/g85tQulnBE8gPHu3/F602E9L7XzfQH6nu9C/Fh9KJzpNe6xgvOx

q3u0UDjvO73ACdMYEFGu+gF5O7WstgsinfpazlJl1tCn592ZdmdEXY8S/zCkg36vZ3GfohIs0UGl

z8CJSOMrvzx9TVg3RkVXN8poxUmHw7z8Cv3zSk4rk5hzVqcRQipB56OduRZxKuP+q8NuOKfRBnSy

EKI1nLnoREI39Ng7w+jWwVgutjGnTGAA1gLIPnzkgagc0cD3QuccXSndMw0FQ8jqfUr8AYYpMlsI

IQUIsICEfKR4uJdogE2eQHlogxUcYs0rxQ+mI9H9Xex/9Lq8f02pgNORt7R9OjAEo9UzDH0ARpN0

wUZt3fvT7ao3SadG2ABiWXtkF0i/CT5LMFdUTCs59oTfl5U/c8+QAw6oOeWTc8nT5GWcPd0rEuGj

FyZoidhtHm+WobglkKcTLdh5JwRD9s9xE+dH789QVPIx9duafGFU3kR9F9u9KyBXj+FNLU1SvJx5

/9jlDHh8k6TTdHl8m1/8O/8FS0gu/BXEFm6f2M41IWv/Qw0zmRSx+YTH48mhNBhct/JFBLt+LA62

e0Pg9eDnrJN9b+G2BSscQzbFMcfSu4J7ix6iCoZ5CaKPMqg2RgTcAelen7CXsT6fZe+0gbPIz96e

qtNrhqU0j58VnbXM/vIJoxTw4G77xMwEh26uoYRpiF4am0X83e22zM8wHY/QU2XjdKVHj6Omz2pU

52OZqldRRmxkB/4b3LJEbiGaRFZKY17WKvlei/52nCwh3EKwhLPN528N6lMd564J8QyHtUdRVUYN

O3udn1JlHoAi4F0jBWcShbww79KoIp0Sgs8f/ZTrGlUY2jbf3Q54l9HRkQvIejKclyAbTmc6f/07

0aI4MKggmD9XUhkU65ggFOIOfY0If3FAzbmaNBxeMIrqE6TxR86t2EiC6GwMws7GvvozwLzzGiRR

EvmQrtvSbV4fnBHAY64qloNFm00WuJU2Ru5B4WNJiz4C8c3Na3gFdtxXZg==

X-Report-Abuse-To: spam@se1-lax1.servconfig.com

X-CMAE-Envelope: MS4wfGTkLN5Q3Etz9Wkc3k/s+48X4HLNxcMTgPNW9dd3KWT52iaJK7tSMbsyZjm0/hi9J87LipDUTpWV2p/qyIS3IuuXa62TTzrOmM1SRoaJXZY91Lfa/lzj

i8Jb2TdRHL58hBIRNSmmPIf9tFZ8lSpapy/8CF5h3TDIczyZlwy+0j+T7U+zeMfEALDdLQAg1NCO7Q==

X-Nonspam: None

Re: Ask HN: Lost $10k as my email was hacked. Any ways to recover it?

#6

Post by czbond » Fri, Oct 26, 2018, 3:59 PM UTC

This is very common issue; I've personally helped a company after they lost much more than this, and had to help prove to insurance/govt agencies/etc. Turn on DKIM, DMARC, and SPF records for your mail domain. Also, never send invoices over email that contain any payment terms (eg: accounts, addresses to mail check to, etc) they should always be in some sort of protected portal. Tell every customer never to accept payment term details from you over email, phone, etc. If you or your client has insurance, start documenting every part of your case with screenshots into a file, and document everything you know NOW, including timestamps, etc.

EDIT: Also, I'd suggest taking orders via a secured portal, and also autheticating large orders by calling a number for a client you already have (never trust their website, or an email from them). Unfortunately, you're out of luck that money.

Re: Ask HN: Lost $10k as my email was hacked. Any ways to recover it?

#7

Post by gagabity » Fri, Oct 26, 2018, 4:02 PM UTC

Unless I am missing something I dont see a hack here, just some spoofed emails.

Re: Ask HN: Lost $10k as my email was hacked. Any ways to recover it?

#8

Post by milanmot » Fri, Oct 26, 2018, 4:04 PM UTC

gagabity wrote: post #7

Unless I am missing something I dont see a hack here, just some spoofed emails.

It's not just a random spoof email. Someone was aware of the entire conversation and send a spoof email at the exact situation resulting in my loss.

Re: Ask HN: Lost $10k as my email was hacked. Any ways to recover it?

#9

Post by C1sc0cat » Fri, Oct 26, 2018, 4:05 PM UTC

You need to speak to the bank regulators an consider talking the press

In the UK the Daily Telegraph finance team they have been covering this in their weekend issues and have had some success in getting things changed here.

Re: Ask HN: Lost $10k as my email was hacked. Any ways to recover it?

#10

Post by milanmot » Fri, Oct 26, 2018, 4:06 PM UTC

czbond wrote: post #6

This is very common issue; I've personally helped a company after they lost much more than this, and had to help prove to insurance/govt agencies/etc. Turn on DKIM, DMARC, and SPF records for your mail domain. Also, never send invoices over email that contain any payment terms (eg: accounts, addresses to mail check to, etc) they should always be in some sort of protected portal. Tell every customer never to accept pa…

Is there anyway to recover that money?