# Someone Trying To Hack Into My GMail Account! **URL:** \ **Category:** Miscellaneous and Personal Stuff I Must Share\ **Created:** [January 16, 2013, 4:42pm UTC](https://boards.straightdope.com/t/someone-trying-to-hack-into-my-gmail-account/647392 "2013-01-16T16:42:50Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![DMark](https://avatars.discourse-cdn.com/v4/letter/d/e68b1a/32.png) [@DMark](https://boards.straightdope.com/u/DMark)\ **Post date:** [January 16, 2013, 4:42pm UTC](https://boards.straightdope.com/t/someone-trying-to-hack-into-my-gmail-account/647392/1 "2013-01-16T16:42:50Z")
Google sent me a warning today that someone was trying to hack into my GMail account - and they even gave me the data of that person/company attempting to gain access and when: Wednesday, January 16, 2013 12:02:16 PM UTC IP Address: 173.86.24.123 ([173-86-24-123.dr01.wlbr.pa.frontiernet.net](http://173-86-24-123.dr01.wlbr.pa.frontiernet.net).) Location: Wilkes-Barre, PA, USA It is not like I have state secrets on my GMail account, but I also don’t want anyone getting in there and spamming friends and family with those email addresses I have on my account. Good that Google warned me. Google stopped their attempt. Allow me to put on my tinfoil hat for a minute: 1. Should I be overly concerned, or does this happen to others? 2. Was I singled out or were they trying to hack into millions of accounts using some automated system? 3. Assuming they had gotten access, what damage could they have done other than access the other email addresses I have and spammed those people? 4. Am I now on some list and they will try this again? 5. My password is not common, but then again it is not exactly encrypted with CIA clearance technology either - would it make a difference if I changed the password, considering they were unsuccessful and were blocked by Google on this attempt? Suggestions and comments welcomed. ---
**Author:** ![Joey\_P](https://avatars.discourse-cdn.com/v4/letter/j/919ad9/32.png) [@Joey\_P](https://boards.straightdope.com/u/Joey_P)\ **Post date:** [January 16, 2013, 4:51pm UTC](https://boards.straightdope.com/t/someone-trying-to-hack-into-my-gmail-account/647392/2 "2013-01-16T16:51:30Z")
Are you sure it was a legit email? I’m thinking the email itself was fake. Even if Google wanted to warn you that someone tried to gain access to your account, I really can’t seem them giving you the IP address of the person/computer that was attempting to do it. Did the email have any links? If you hover over the links did they go where they say they should go? ---
**Author:** ![Patty\_O\_Furniture](https://avatars.discourse-cdn.com/v4/letter/p/96bed5/32.png) [@Patty\_O\_Furniture](https://boards.straightdope.com/u/Patty_O_Furniture)\ **Post date:** [January 16, 2013, 4:55pm UTC](https://boards.straightdope.com/t/someone-trying-to-hack-into-my-gmail-account/647392/3 "2013-01-16T16:55:03Z")
A huge concern or me would be that somebody could fish through my gmail history (wherein everything is “helpfully” archived by default rather than deleted) and find out what other services I use, and send password resets to them to gain access. They could get you locked-out of your Amazon, Apple and perhaps even banking accounts. You might be interested in reading Matt Honan’s epic ID theft ordeal of last summer: > **[How Apple and Amazon Security Flaws Led to My Epic Hacking](https://www.wired.com/2012/08/apple-amazon-mat-honan-hacking/)** > > In the space of one hour, my entire digital life was destroyed. First my Google account was taken over, then deleted. Next my Twitter account was compromised, and used as a platform to broadcast racist and homophobic messages. Here's the story of... ---
**Author:** ![DMark](https://avatars.discourse-cdn.com/v4/letter/d/e68b1a/32.png) [@DMark](https://boards.straightdope.com/u/DMark)\ **Post date:** [January 16, 2013, 4:58pm UTC](https://boards.straightdope.com/t/someone-trying-to-hack-into-my-gmail-account/647392/4 "2013-01-16T16:58:59Z")
> [@Joey\_P](#): > > Are you sure it was a legit email? I’m thinking the email itself was fake. Even if Google wanted to warn you that someone tried to gain access to your account, I really can’t seem them giving you the IP address of the person/computer that was attempting to do it. > > Did the email have any links? If you hover over the links did they go where they say they should go? Hmm…now that you mention that, when hovering over the link they sent to change my password (which I didn’t click) or to allow access using troubleshooting (which I also didn’t click), both of those are http:// instead of Google’s normal http **s** :// Maybe this is the clue - the email itself was an attempt to get me to click there and go in and change my password for them to “see”? ---
**Author:** ![DMark](https://avatars.discourse-cdn.com/v4/letter/d/e68b1a/32.png) [@DMark](https://boards.straightdope.com/u/DMark)\ **Post date:** [January 16, 2013, 5:05pm UTC](https://boards.straightdope.com/t/someone-trying-to-hack-into-my-gmail-account/647392/5 "2013-01-16T17:05:48Z")
> [@Patty\_O\_Furniture](#): > > A huge concern or me would be that somebody could fish through my gmail history (wherein everything is “helpfully” archived by default rather than deleted) and find out what other services I use, and send password resets to them to gain access. They could get you locked-out of your Amazon, Apple and perhaps even banking accounts. You might be interested in reading Matt Honan’s epic ID theft ordeal of last summer: > > [http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-honan-hacking/](http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-honan-hacking/) Crap…now you have made me even more paranoid and my tinfoil hat is hurting my head! Yesterday I noticed my smart phone was acting all weird and not allowing me access to sites I normally access…I chalked it up to oddness and simply took out the battery and then rebooted the phone. That seemed to work, but now I wonder if this was all somehow related to one of the apps I have on my smart phone. Now the joy is to figure out which app, if any, was the villain in this series of events. Crap, crap, crap… ---
**Author:** ![Patty\_O\_Furniture](https://avatars.discourse-cdn.com/v4/letter/p/96bed5/32.png) [@Patty\_O\_Furniture](https://boards.straightdope.com/u/Patty_O_Furniture)\ **Post date:** [January 16, 2013, 5:14pm UTC](https://boards.straightdope.com/t/someone-trying-to-hack-into-my-gmail-account/647392/6 "2013-01-16T17:14:50Z")
Anyone who saves (archives) potentially sensitive information in their gmail account (or google services like google docs/drive) should turn on [two-factor authentication](http://support.google.com/accounts/bin/answer.py?hl=en&answer=180744). You will have to go through a process to re-enable gmail access on all of your devices, but I think it’s worth it. ---
**Author:** ![JSexton](https://avatars.discourse-cdn.com/v4/letter/j/96bed5/32.png) [@JSexton](https://boards.straightdope.com/u/JSexton)\ **Post date:** [January 16, 2013, 5:26pm UTC](https://boards.straightdope.com/t/someone-trying-to-hack-into-my-gmail-account/647392/7 "2013-01-16T17:26:43Z")
Well, it might be for real. I think there must have been another big board that got their database compromised, because yesterday my paypal account got hacked. The email address and password on it (stupidly!) is a combination I’ve used elsewhere in the past. Fortunately papyal customer service rocks and immediately reversed the transactions that moved all the money offshore. At any rate, it could be that you’ve used your gmail account to log into a board that got compromised, and they were attempting to use the password that was associated with that account. It makes perfect sense to supply the IP address, so you can potentially identify whether that was really you in an unusual access point. ---
**Author:** ![grude](https://avatars.discourse-cdn.com/v4/letter/g/e47774/32.png) [@grude](https://boards.straightdope.com/u/grude)\ **Post date:** [January 16, 2013, 5:27pm UTC](https://boards.straightdope.com/t/someone-trying-to-hack-into-my-gmail-account/647392/8 "2013-01-16T17:27:57Z")
Gmail does this as a matter of course I think, they’ve sent me emails that an IP in another country had accessed my account(it was me in another country). ---
**Author:** ![DMark](https://avatars.discourse-cdn.com/v4/letter/d/e68b1a/32.png) [@DMark](https://boards.straightdope.com/u/DMark)\ **Post date:** [January 16, 2013, 5:43pm UTC](https://boards.straightdope.com/t/someone-trying-to-hack-into-my-gmail-account/647392/9 "2013-01-16T17:43:47Z")
OK - so I did go in and change password - making it a bit more complicated but still easy enough for my stubby fingers to type in on my smart phone tiny keys. I haven’t turned on my smart phone today yet - so we’ll see how things work there later. Thanks for comments and suggestions - keep 'em coming and let me know if this has happened to anyone else and what you did about it. ---
**Author:** ![YogSothoth](https://avatars.discourse-cdn.com/v4/letter/y/8edcca/32.png) [@YogSothoth](https://boards.straightdope.com/u/YogSothoth)\ **Post date:** [January 16, 2013, 6:15pm UTC](https://boards.straightdope.com/t/someone-trying-to-hack-into-my-gmail-account/647392/10 "2013-01-16T18:15:17Z")
Same thing happened to me a week ago on Facebook. I logged on at home and FB told me that an attempt to log into my account from Bogota, Colombia was tried. I don’t think much of FB’s privacy information selling, but I do like their security when it works FYI I should mention that I’m NOT from Bogota, Colombia have never been there. ---
**Author:** ![aruvqan](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/aruvqan/32/2891_2.png) [@aruvqan](https://boards.straightdope.com/u/aruvqan)\ **Post date:** [January 17, 2013, 12:09am UTC](https://boards.straightdope.com/t/someone-trying-to-hack-into-my-gmail-account/647392/11 "2013-01-17T00:09:55Z")
I get ‘official notices’ from MMORPGs about my ‘illegal efforts to sell my accounts’ for games I have never actually made an account nor played … :dubious::rolleyes: ---
**Author:** ![Lucas\_Jackson](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/lucas_jackson/32/303_2.png) [@Lucas\_Jackson](https://boards.straightdope.com/u/Lucas_Jackson)\ **Post date:** [January 17, 2013, 2:51am UTC](https://boards.straightdope.com/t/someone-trying-to-hack-into-my-gmail-account/647392/12 "2013-01-17T02:51:12Z")
Apparently hackers are targeting mid level targets now. Some good info can be found here: [Kill the Password: A String of Characters Won't Protect You | WIRED](http://www.wired.com/gadgetlab/2012/11/ff-mat-honan-password-hacker/) ---
**Author:** ![SeaDragonTattoo](https://avatars.discourse-cdn.com/v4/letter/s/df705f/32.png) [@SeaDragonTattoo](https://boards.straightdope.com/u/SeaDragonTattoo)\ **Post date:** [January 17, 2013, 3:11am UTC](https://boards.straightdope.com/t/someone-trying-to-hack-into-my-gmail-account/647392/13 "2013-01-17T03:11:47Z")
I can’t imagine an email that provides a link for you to click and change your password would be legit. To me, that’s the same as just asking your password. ---
**Author:** ![FlyByNight512](https://avatars.discourse-cdn.com/v4/letter/f/82dd89/32.png) [@FlyByNight512](https://boards.straightdope.com/u/FlyByNight512)\ **Post date:** [January 17, 2013, 3:22am UTC](https://boards.straightdope.com/t/someone-trying-to-hack-into-my-gmail-account/647392/14 "2013-01-17T03:22:47Z")
> [@DMark](#): > > Hmm…now that you mention that, when hovering over the link they sent to change my password (which I didn’t click) or to allow access using troubleshooting (which I also didn’t click), both of those are http:// instead of Google’s normal http **s** :// > > Maybe this is the clue - the email itself was an attempt to get me to click there and go in and change my password for them to “see”? That’s a dead giveaway, even if the hover-over address looked right. Legitimate businesses never, ever send email with a ‘go here to change your password’ link, because scams like this are so common. Legitimate businesses will tell you to go to their website and change the password there. Here’s how you know it’s fake: It sounded scary. If a real business has to tell you that your account’s possibly been compromised, they’re going to make it as non-frightening as possible. Scammers, by contrast, want to scare people into acting emotionally rather than rationally. If the email makes your stomach tense up, there’s a 99% chance it’s a scam. Same goes for the “OMG your computer has eleventy billion viruses, click here now to fix it” popups that you’ll sometimes see. Real virus warnings are in boring colors and usually say “We found and deleted a virus. No action necessary, just thought you should know.” Google does have a [hacker warning](http://www.dailymail.co.uk/sciencetech/article-2155220/Google-warn-Gmail-users-firm-suspects-spies-hacking-email.html), but it doesn’t arrive in an email and it doesn’t give you any links to change your credentials. Another [article](http://www.techweekeurope.co.uk/news/google-adding-hack-warning-to-gmail-accounts-6081) adds more detail: > [@](#): > > “While we don’t have the capability to determine the specific location from which an account is accessed, a login appearing to come from one country and occurring a few hours after a login from another country may trigger an alert,” blogged Google Engineering Director Pavni Diwanji. So they don’t hand out IP addresses and locations. It would be worthless information anyway - hackers use proxies. Usually several of them. I’m pretty sure your account is fine. Changing the password anyway is a good idea - just do so from inside Gmail and not from that link! ---
**Author:** ![AaronX](https://avatars.discourse-cdn.com/v4/letter/a/7bcc69/32.png) [@AaronX](https://boards.straightdope.com/u/AaronX)\ **Post date:** [January 17, 2013, 3:24am UTC](https://boards.straightdope.com/t/someone-trying-to-hack-into-my-gmail-account/647392/15 "2013-01-17T03:24:01Z")
> [@Joey\_P](#): > > Even if Google wanted to warn you that someone tried to gain access to your account, I really can’t seem them giving you the IP address of the person/computer that was attempting to do it. Facebook does this all the time. This is what it said when I tried to log in from my Kindle [https://lh5.googleusercontent.com/-akn5JjyE0MM/TZABlhOWhjI/AAAAAAAAxCM/4B3PFyZcEEU/s800/IMG\_0945.PNG](https://lh5.googleusercontent.com/-akn5JjyE0MM/TZABlhOWhjI/AAAAAAAAxCM/4B3PFyZcEEU/s800/IMG_0945.PNG) (I think Kindle redirects all Internet traffic to Amazon’s servers - that’s how they control which websites you can visit, and how you can visit Facebook while in China) FB also does that when you log into while in, er, private mode. ---
**Author:** ![Anamorphic](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/anamorphic/32/3057_2.png) [@Anamorphic](https://boards.straightdope.com/u/Anamorphic)\ **Post date:** [January 17, 2013, 4:05pm UTC](https://boards.straightdope.com/t/someone-trying-to-hack-into-my-gmail-account/647392/16 "2013-01-17T16:05:54Z")
I had the same thing happen a while back. Never figured out how they got the password, but they did. Immediately afterwards, I found out about, and activated, Google’s Two Step Verification system. I highly recommend it if you’re concerned about your email security (hell, I recommend it to people who _aren’t_ particularly concerned about their email security): > **[Turn on 2-Step Verification - Computer - Google Account Help](https://support.google.com/accounts/answer/185839?hl=en&visit_id=638239605702950949-3552144444&rd=1)** > > With 2-Step Verification, also called two-factor authentication, you can add an extra layer of security to your account in case your password is stolen. After you set up 2-Step Verification, you can s ---
**Author:** ![RyJae](https://avatars.discourse-cdn.com/v4/letter/r/9d8465/32.png) [@RyJae](https://boards.straightdope.com/u/RyJae)\ **Post date:** [January 18, 2013, 7:36pm UTC](https://boards.straightdope.com/t/someone-trying-to-hack-into-my-gmail-account/647392/17 "2013-01-18T19:36:52Z")
A lot of misinformation in here. Yes Google sends these out > [@](#): > > Your name > > Someone recently tried to use an application to sign in to your Google Account, [Youremail@gmail.com](mailto:Youremail@gmail.com). We prevented the sign-in attempt in case this was a hijacker trying to access your account. Please review the details of the sign-in attempt: > > Monday, November 19, 2012 8:30:44 PM GMT > IP Address: 171.112.137.20 > Location: Huanggang, Hubei, China > > If you do not recognize this sign-in attempt, someone else might be trying to access your account. You should sign in to your account and reset your password immediately. Find out how at [Change or reset your password - Computer - Google Account Help](http://support.google.com/accounts?p=reset_pw) > > If this was you, and you want to give this application access to your account, complete the troubleshooting steps listed at [http://support.google.com/mail?p=client\_login](http://support.google.com/mail?p=client_login) > > Sincerely, > The Google Accounts Team And for the future, they record all attempts by IP for login. Just click the “details” link on the bottom right of the gmail page. It is how I found someone else was accessing my account last year before I changed the password 🙂 Another thing is, sometimes it prevents an authorized signin. By a phone app or something you let use your gmail account for any number of reasons. If that is the case you could ignore it I suppose. The best advice is don’t click the links, go to gmail manually and update your password if you get one of these emails. Just to be safe. ---
**Author:** ![filmore](https://avatars.discourse-cdn.com/v4/letter/f/7993a0/32.png) [@filmore](https://boards.straightdope.com/u/filmore)\ **Post date:** [January 18, 2013, 7:53pm UTC](https://boards.straightdope.com/t/someone-trying-to-hack-into-my-gmail-account/647392/18 "2013-01-18T19:53:35Z")
As long as you are changing your password, make sure it is unique and only used on gmail. A very common hacker technique is to hack some other website where you have created an account. Likely you specified your email during signup. Hackers will take your password from that other website and attempt to log in to the email account registered to that site. If you use the same password on gmail and random websites, your gmail will eventually get hacked. ---
**Author:** ![Patty\_O\_Furniture](https://avatars.discourse-cdn.com/v4/letter/p/96bed5/32.png) [@Patty\_O\_Furniture](https://boards.straightdope.com/u/Patty_O_Furniture)\ **Post date:** [January 19, 2013, 1:15am UTC](https://boards.straightdope.com/t/someone-trying-to-hack-into-my-gmail-account/647392/19 "2013-01-19T01:15:48Z")
> [@RyJae](#): > > A lot of misinformation in here. Where’s the misinformation? We all seem to be saying the same thing. I don’t think Google actually sends you an email - they post a warning flag near the top of your inbox display that you can click on for more information. ---
**Author:** ![RyJae](https://avatars.discourse-cdn.com/v4/letter/r/9d8465/32.png) [@RyJae](https://boards.straightdope.com/u/RyJae)\ **Post date:** [January 19, 2013, 7:01am UTC](https://boards.straightdope.com/t/someone-trying-to-hack-into-my-gmail-account/647392/20 "2013-01-19T07:01:55Z")
> [@Patty\_O\_Furniture](#): > > **Where’s the misinformation**? We all seem to be saying the same thing. > > **I don’t think Google actually sends you an email** - they post a warning flag near the top of your inbox display that you can click on for more information. \*Bolded by me That was the actual real email that Google sends that I posted… It is misinformation to say Google doesn’t send them kind of emails. Google sends those emails \*\*Dmark \*\* was worried about, with the offending IP/Locale included. I added a warning, that if you get the email to go ahead and manually go to gmail to change your password/look at the details summary. You all saying the same thing doesn’t make it right. [Next page](https://boards.straightdope.com/t/someone-trying-to-hack-into-my-gmail-account/647392.md?page=2)