# My friend's e-mail was phished. What to do now?

**URL:** <https://boards.straightdope.com/t/my-friends-e-mail-was-phished-what-to-do-now/654289>\
**Category:** Factual Questions\
**Created:** [March 29, 2013, 7:42pm UTC](https://boards.straightdope.com/t/my-friends-e-mail-was-phished-what-to-do-now/654289 "2013-03-29T19:42:13Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Stan\_Shmenge](https://avatars.discourse-cdn.com/v4/letter/s/94ad74/32.png) [@Stan\_Shmenge](https://boards.straightdope.com/u/Stan_Shmenge)\
**Post date:** [March 29, 2013, 7:42pm UTC](https://boards.straightdope.com/t/my-friends-e-mail-was-phished-what-to-do-now/654289/1 "2013-03-29T19:42:13Z")

</div>

She responded to one of those “Final Warning we are going to close your account” thingys and gave her email address and password.

> [@](#):
>
> Dear Yahoo! Mail Classic user,  
> This account has been spotted by our new SSL, :rolleyes: To confirm that this account is not an automated Virus and its not been run for illegal activities.Please take a second to update your email by following the reference link below  
> clicking here Once the information provided matches what is on our record, Your account will work as normal after the verification is processed.

Bad grammar, nonsense technical jargon, and a link that went to here: fixedgearwizardewqeee. 3owl. com

After she “logged in” she gave her phone number as well.

So, what can she expect and what should be done. I already told her to change her password.

---

<div class="post-metadata">

**Author:** ![Alley\_Dweller](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/alley_dweller/32/430_2.png) [@Alley\_Dweller](https://boards.straightdope.com/u/Alley_Dweller)\
**Post date:** [March 29, 2013, 7:51pm UTC](https://boards.straightdope.com/t/my-friends-e-mail-was-phished-what-to-do-now/654289/2 "2013-03-29T19:51:22Z")

</div>

Most people use the same password on dozens of accounts.  
Make sure she changes every account that uses the same password.

---

<div class="post-metadata">

**Author:** ![filmore](https://avatars.discourse-cdn.com/v4/letter/f/7993a0/32.png) [@filmore](https://boards.straightdope.com/u/filmore)\
**Post date:** [March 29, 2013, 7:51pm UTC](https://boards.straightdope.com/t/my-friends-e-mail-was-phished-what-to-do-now/654289/3 "2013-03-29T19:51:28Z")

</div>

She should change her pw on any site which uses the compromised pw.

Some sites, like amazon/facebook, use email as the login. The hackers can try to login using her email/pw on those sites.

They may search for her email in user databases hacked from other websites. If so, they may find her user id on those sites and try to use her pw to login.

She should also do an extensive virus/trojan scan of her computer. The link may have downloaded a virus.

---

<div class="post-metadata">

**Author:** ![xizor](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/xizor/32/102_2.png) [@xizor](https://boards.straightdope.com/u/xizor)\
**Post date:** [March 29, 2013, 8:05pm UTC](https://boards.straightdope.com/t/my-friends-e-mail-was-phished-what-to-do-now/654289/4 "2013-03-29T20:05:38Z")

</div>

Make sure her phone provider does not allow 3rd party charges added to her phone bill.

---

<div class="post-metadata">

**Author:** ![Stan\_Shmenge](https://avatars.discourse-cdn.com/v4/letter/s/94ad74/32.png) [@Stan\_Shmenge](https://boards.straightdope.com/u/Stan_Shmenge)\
**Post date:** [March 29, 2013, 8:50pm UTC](https://boards.straightdope.com/t/my-friends-e-mail-was-phished-what-to-do-now/654289/5 "2013-03-29T20:50:11Z")

</div>

I am thinking their bot may have gotten her password recovery information. She should probably change all that too, no?