Imagine getting a phone call from a friend asking about a party invitation you sent them – except you never sent one!
If this happens to you, don’t panic. You are not alone, and your account might not even be broken into. Here is what is actually going on, why it happens, and what you need to do right now.
1. How Did This Happen?
Someone sent emails that look like they came from you.
Think of it like sending a physical letter through the post office: anyone can write your name and return address on the back of an envelope, even if they aren’t you. In the computer world, fake return addresses are called “email spoofing.”
2. How Did Scammers Get My Friends’ Emails?
Scammers didn’t necessarily look inside your personal address book. They usually get contacts in two ways:
- Shared group lists: If you and your friends were ever on the same group email, online group, or social media page, scammers can copy those lists.
- A friend’s account was compromised: If just one of your friends had their address book exposed in a previous data breach, scammers can match their contact list with your email address.
3. Is My Email Account Actually Hacked?
Most likely, no.
If you can still log into your email normally and you do not see those party invitation emails in your “Sent” folder, your address was likely just copied onto the envelope, not broken into.
What You Need to Do Right Now
- Warn your friends: Let them know the party invitation is fake. Tell them not to click any links or open attachments, and to delete the email immediately. You can use social media platforms like Facebook to broadcast an announcement.
- Check your “Sent” folder: If the fake emails do show up in your sent messages, someone has access to your account. Change your password immediately and log out of all devices.
- Change your password anyway: Even if you aren’t hacked, changing your password to something strong and unique is a smart precaution.
How to Protect Yourself in the Future
Turn on 2-Step Verification if you don’t have it enabled already. This adds a second lock to your email. When logging in on a new device, Google will text or notify your phone to confirm it is really you.
Never reuse passwords: Use a different password for your email than you use for shopping or news websites.
Use “Bcc” for group emails: When emailing large groups, put recipient addresses in the Bcc (Blind Carbon Copy) line so everyone’s email address stays hidden from outside eyes.