From a computer you trust, change the mailbox password and recovery details, then check the reply-to address, forwarding, filters and signature. Turn on two-step verification, and send clients one calm message saying the request was not yours.

The first phone call

A client phones on a Saturday morning, sounding embarrassed. She has an email from you saying you are stuck overseas, your wallet and phone are gone, and you need money wired today for a hotel bill.

It came from your address and carries your name. By lunchtime three more people have called or replied, and one asks where to send the money.

You are at home. Someone else has your mailbox password, and they have written to everyone in your address book.

Most clients see through the message. The real damage is in the mailbox, and in what its uninvited visitor can still do there.

How someone gets the password

Mailbox passwords are usually taken in ordinary ways, through a moment of trust or an old habit:

The route matters because, if it was software on your own computer, changing the password there hands over the new one too.

Change the password from a clean computer

Sign in from a different computer or a tablet you trust, and change the password to a long one you have never used anywhere else.

If the password has been changed and you cannot sign in, start the provider's account recovery at once, answering its questions as precisely as you can.

If the mailbox is on your business's own domain, call whoever looks after your email and website. They can reset the password on the server and see what was sent.

Settings that outlast a new password

Getting back in is not the end of it. Whoever was in your mailbox often changes settings that keep working after you lock them out.

Check the reply-to address first. It is often set to an address one letter different from yours, so replies to the fake message, and to your genuine ones, go to the stranger.

Then check forwarding and filters. A rule that copies every incoming message to an outside address, or sends certain replies straight to the trash, can run for months unnoticed.

Check the signature, the automatic reply, any extra sending addresses, and the devices and programs allowed to use the account.

Recovery details and other accounts

Recovery details decide who can reset the password next time. Check the recovery phone number, the backup email address and any security question, and replace anything you did not set.

Then consider what this mailbox controls. Your bank, domain registration, website, social accounts and bookkeeping software may all send password resets here. Change any password that matched the old one.

Finally, run a full scan on every computer you used to read this mailbox. If the way in was software, it is still there.

A worked example

An image consultant in Vancouver advises professionals on wardrobe and presentation, with a part-time assistant and a small studio. Her business email was a free webmail account she had used for years.

One Sunday, clients began texting her about a message asking for money to get home from abroad. When she tried to sign in, her password no longer worked.

Recovery took most of the afternoon, because her recovery phone number had been replaced. Once in, she found a rule forwarding every incoming message to an unfamiliar address.

The reply-to was a near copy of her own address, and her contacts had been deleted. Clients answering her real messages that week would have been writing to the stranger.

She removed the rule, restored the reply-to and recovery details, turned on two-step verification and changed two other passwords. That evening she sent one short message to every client.

The forwarding rule was the important find, since a new password alone would have left copies of client messages going elsewhere.

Within the month her email moved to her own domain, looked after by the person who manages her website.

Two-step verification

Two-step verification, offered by most large email services, asks for a one-time code from your phone whenever someone signs in from an unfamiliar computer. A password on its own is then no longer enough.

It adds a moment on a new device and almost nothing on your own computer, which is a small price for the mailbox that can reset everything else.

What to tell clients

Clients need to hear from you briefly, from your real account, in a tone that says the problem is annoying and dealt with.

Say that a message sent from your address asking for money did not come from you, that they should delete it without replying, and that the account is secure again.

Ask anyone who sent money or clicked a link in it to call you. Phone the clients who called you, and anyone likely to act on a request in your name.

Add one line you can repeat in future: you will never ask a client to wire money by email. Then anyone who receives such a request knows what to do with it.

The counter-case

Sometimes the message did not come from your mailbox at all. Anyone can put your name and address in the From line of a message sent from elsewhere, and your sent folder will show nothing.

In that case the password is not the problem, though changing it does no harm. The fix is on the domain, with settings that tell receiving servers which servers may send your mail.

That is a job for whoever looks after your domain and email. Either way, clients still need the same calm message from you.

Taking the mailbox back

  1. Change the password from a computer you trust.
  2. Restore the reply-to address to your own.
  3. Remove forwarding rules and filters you did not set.
  4. Replace the recovery details and security question.
  5. Turn on two-step verification for the mailbox.
  6. Change any password that matched the old one.
  7. Send clients one short message from your real account.

Step three is the one people skip. A forwarding rule keeps sending your clients' messages to a stranger long after the password has changed, and nothing in the inbox shows it.

A mailbox also makes a poor store for the documents clients send, and the secure upload page that can replace it is covered in client documents too large for the office mailbox.

Frequently asked questions

How can I tell whether my mailbox was taken over?

Check recent sign-in activity, the reply-to address, forwarding and recovery details, and look in the sent folder. If nothing there has changed, your address may have been forged instead.

What should I change first?

The password, from a computer you trust, then the recovery phone, backup address and security question. Without those, the same person can reset the password again.

Why check forwarding after changing the password?

Forwarding rules keep working after the password changes. A rule copying incoming mail to an outside address can run for months with nothing showing in your inbox.

What is a changed reply-to address?

A setting that sends replies somewhere other than your own address, often to one a letter different from yours, so clients answering you write to someone else.

What should I tell my clients?

That a message from your address asking for money was not from you, that they should delete it, and that anyone who sent money or clicked a link should call you.

Does two-step verification help?

Yes. It asks for a code from your phone when someone signs in from an unfamiliar device, so a password alone is no longer enough to get in.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Clients phoning about an email you never sent?

Call us, and we will check your mailbox settings with you and can move your email onto your own domain.

Start a Conversation