Preventing and Recovering from Email Being Hacked

Scammers manipulate people by exploiting their trust in the people in their community. They use this trust to trick you into sharing your personal information. Once they have it, they use your good name and reputation to spread the scam to other people in your network. 

A version of this scam happened in New York Quarterly Meeting recently. An NYC Friend had access to his email account compromised. The attacker sent emails from his personal email account to the people on his contact list, spreading the attack onward. A Friend received one of those emails, which had the subject “Fwd: Scanned file from…” and a link to download the file. The email came from the sender’s email address and included his signature line. This recipient was suspicious and tried to confirm that the email was legitimate. She replied to the email several days later, asking if the link was genuine. The emailed reply read, "Yes go on." 

The Friend clicked the link in the email that led to what looked like a perfect copy of Google’s sign-in page. The email address was already entered and the password box was highlighted, so she entered her password. And then the attacker had access to her email and password. 

This specific kind of hacking was a “phishing” attack, designed to trick a person into giving up their private information. It relies upon our very human trait to trust those that we know. The attacker impersonates a friend. To prevent attacks from happening to you, try calling or texting the sender separately to confirm a questionable email is genuine. Do this even if the email was sent several days earlier. 

Once the unsuspecting friend entered her password a Windows batch file (".bat") was downloaded to her computer. She discovered and deleted the file, which seemed to be the end of the trouble. However the next morning she began to receive texts from friends asking if an email from her with the subject line "Scanned file from…" was genuine. The hackers had used her password to gain access to her account and sent a phishing email to her contacts, pretending to be her.

The Friend quickly reset her Google password and confirmed with Google that the account was secure. To stop the spread of the attack, she contacted as many F/friends as she could, letting them know her email had been hacked and not to open an email with the subject line "Scanned file from…" She then ran a full scan of her laptop using antivirus software, had a tech expert examine her laptop, and changed her Windows PIN and Microsoft password. 

If you recently received an email from an NYC Friend with the subject “Scanned File From…” select the email in your inbox and click “report phishing” or “move to junk.” The Friends in this story have regained control of their accounts, and future emails from them should be safe. 

Key Takeaways

Emails and phone calls can easily be “spoofed” by scammers; the sender of the email or call can be altered to appear as someone you know. Do not trust odd messages even when they seem to be coming from someone you know and trust. If a communication seems weird to you at all, contact the person or company yourself, using a phone number you already know or an alternate email address. Do not reply to the email or message directly or call them back on the phone number they used to call you. 

Recovery — If your email gets hacked:

• Delete any files that may have been downloaded and also delete them from your Recycle or Trash bin — do not open or click them
• Follow the steps advised by your email provider for re-securing your account; here’s Google’s. 
  • Don’t forget to check your email settings for forwarding rules or filters the attacker may have left behind
  • Sign out of your account on all the devices where you are signed in, then log in again after you change your password
• Let people know — get a message out to your contacts, Quaker meeting, and the NYQM office 
• If the email account is an @nycquakers.org or @15streetmeeting address, contact jose@nycquakers.org
• Confirm with your email provider that your account is now secured
• Implement the prevention steps below

These scams can be reported to the FBI's Internet Crime Complaint Center at ic3.gov, which is worth doing even if nothing was lost.

Prevention — how to keep from getting hacked:

1. Turn on 2-factor authentication for all important sites and accounts
   1. This makes signing into a website slightly more annoying 
   2. But it provides much greater protection for your private information.
2. Use a password manager like 1Password
   1. Create a “vault” with all of your passwords, accessible by a single password
   2. Install the password manager app on your phone and laptop to access your passwords wherever you are
   3. 1Password costs $3/month as of Sept. 8, 2026
3. If you serve on a Quaker committee, consider using an email account for committee work that is separate from your personal email address. If you’re serving on a NYQM or 15th Street Meeting committee, contact jose@nycquakers.org to add you to a new or existing nycquakers.org or 15thstreetmeeting.org email address. Other meetings (Brooklyn, Morningside) manage their own email accounts and can be contacted directly.

Helpful resources that are helpful to both prevent and respond to these attacks: 

• Spot Malicious Sites and Phishing Attempts, from Consumer Reports' Security Planner: https://securityplanner.consumerreports.org/tool/protect-yourself-from-phishing
• Secure a hacked or compromised Google Account, the step-by-step for anyone who needs to recover: https://support.google.com/accounts/answer/6294825
• Recognize and Report Phishing, from the Cybersecurity and Infrastructure Security Agency (CISA): https://www.cisa.gov/secure-our-world/recognize-and-report-phishing

These tech support videos by @Ask Leo! on YouTube are recommended: 

• My Email is Hacked! How Do I Fix it? 
• 12 Steps to Keep from Getting Your Account Hacked