Email Account Takeover → Contact-List Scams
After stealing your email login, scammers read your messages and email your contacts pretending to be you, asking for money or spreading phishing.
Think a message like this reached you? You can check it right now.
What this scam is
Once a criminal has your email password (via phishing or a reused/leaked password), they log in, read your mail, and message your contacts as 'you' — asking for gift cards or a wire for an emergency, or sending phishing links your contacts trust because they come from you. They may set hidden forwarding rules to keep watching. Email is the recovery point for many accounts, so a takeover can cascade into your bank, shopping, and social accounts.
What it usually looks like
- Contacts saying they got odd messages 'from you.'
- Sent mail you didn't write, or missing/read messages.
- Password/recovery changes you didn't make.
- New forwarding or filter rules in your settings.
Common warning signs
- Friends receiving urgent money requests 'from you.'
- Unfamiliar sent items or login locations.
- Recovery email/phone changed.
- Hidden auto-forwarding rules.
Example wording scammers use
“(To your contacts) 'I'm stuck and can't talk — can you grab me some gift cards? I'll pay you back.'”
“(To your contacts) 'Check out this document,' with a phishing link.”
These are illustrative examples written by ScamSplain, not real messages.
What the scammers want
- To scam your contacts using your identity.
- To pivot into your other accounts via email recovery.
- Ongoing access via hidden rules.
What to do
- Use a strong, unique email password and app-based two-factor.
- Periodically review sign-in activity, forwarding rules, and recovery settings.
- Warn contacts to verify money requests by phone.
- Never reuse your email password elsewhere.
What to do if you already responded
- Change the email password, revoke sessions, and remove unknown forwarding/filters.
- Reset passwords on accounts tied to that email; enable 2FA.
- Warn your contacts and report at reportfraud.ftc.gov.