You might have been hacked if:

• Friends and family are getting emails or messages you didn't send.
• Your Sent messages folder has messages you didn't send, or it has been emptied.
• Your social media accounts have posts you didn't make.
• You can't log into your email or social media account.

What to do if email is hacked:

• Update your system and delete any malware.  The first thing you should do if your account gets hacked is to run an end-to-end antivirus scan. This means skipping the "quick scan" setting in favor of a deep scan to identify and eliminate not only all forms of malware (including Trojans and spyware to keyloggers that could be tracking your keystrokes even after the hack has been identified) and potentially unwanted applications.  It's important to make sure you're clean before you change any of your other sensitive information to avoid restarting the cycle.  Also, set your security software, internet browser, and operating system to update automatically.
• Review Social Media Accounts.  Look for changes your social networking sites, look for changes to the account since you last logged in.  Look at your personal details, review any third-party apps connected to your account, and check your security questions and answers and your backup email addresses and/or phone numbers. If you think your hacker had a chance to scan your security questions and backup accounts, try to change these on the compromised account and on any other account that relies on the same information. This will prevent the bad actor from using your personal details to breach other accounts in the future.
• Change Your Passwords.  Once your computer is free of malware, it's time to change your password. If you've lost access to your account, you may need to contact the email provider directly, prove who you are and ask for a password reset. Choose a new password that is very different from your old one and make sure it doesn't contain strings of repeated characters or numbers. Your password should be unique for each account, complex (i.e., a mix of letters, numbers and special characters) and at least 15 characters long.
• Contact Other Online Services.  It's critical to change your passwords with other payment-based accounts such as Amazon, Netflix, LinkedIn, credit card companies, etc. Make sure you use different passwords for every online account.
• Notify People You Know.  Tell your friends, family and anyone else on your email contact list that they might have gotten a malicious link.. During the period when attackers had control of your account, they could have sent dozens or even hundreds of fraudulent emails to everyone you know, in turn giving them access to a new set of victims. 
• Change Your Security Questions.  While your password was the most likely attack route, it's also possible that hackers broke into your account after answering your security questions. Many users choose the same answer to common security questions.  In order to further protect your email, be sure to employ the multi-factor authentication that many providers allow to gain access to your password, including using secondary email addresses or text messages, since security questions alone are not enough.
• Report the Hack.  If you haven't already, contact your email provider and report the hack. This is important even if your hacked email didn't cause you to lose access since it helps providers track scam-based behavior. In addition, your email provider may be able to offer details about the origin or nature of the attack.
• Contact Credit Agencies.  Contact the three credit reporting agencies TransUnion, Experian and Equifax to monitor your accounts in the months after you've been hacked.
• Consider Your ID Protection Options.  If you've been hacked, another idea worth considering is an ID protection service. These services typically offer real-time email and online retail account monitoring, in addition to credit score reporting, and personal assistance in the event of an identity theft. Your financial institution will offer this program for a small monthly fee.
• Review All Email Accounts.  If the breach affected a service that includes email, such as your Google account, check the email account for sent messages or for new filters. For example, clever hackers can set up filters that forward all incoming mail to an address you don't recognize. Delete such filters to prevent people from worming their way back into your account in the future. This is particularly important because you can reset many other accounts' passwords, and receive notifications about suspicious activity, over email. You don't want an eavesdropper to nab those recovery messages.  Also, check that your email signature and "away" message don't contain unfamiliar links or forwards. 
• Create a New Email Account.  Sometimes it's not worth picking up where you left off. If this isn't the first time hacked email has been a problem, or if your provider doesn't seem to be taking steps to mitigate the amount of spam you receive, it may be time for a switch. Look for a service that offers default encryption of your emails and solid customer service in the event of an issue.

Properly Managing Your Email 

• Keep a minimum of three email accounts. Your first email account should be used for personal conversations and contacts, and your third email account should be used as a general catch-all for all hazardous behavior. 
• Your second email account should be your work account that is used exclusively for work-related conversations.  Don't risk your company's security by using a personal computer or email address at work.
• Your third 'catch-all' account should be used to sign up for newsletters and contests.  You should plan on having to dump and change out this account every six months.
• When you are checking your email at a public computer, you need to log out of your email and close the browser window completely. 
• Delete browser cache, history and passwords.
• Do not use un-secure email accounts to send and receive sensitive corporate information. 
• Unless you need a written record of something or are communicating across the globe, consider whether a simple phone call rather than an email is a better option. Compared with accessing email through a public computer, a phone call is more secure option.

Emailing the Right People

• Don't use the Blind Carbon Copy (BCC) option.  
• Don't use the "Reply All" button.  
• Be careful forwarding email.  Forwarding emails can create a significant security threat for yourself and the earlier recipients of the email. As an email is forwarded, the recipients of the mail (until that point in time) are automatically listed in the body of the email. As the chain keeps moving forward, more and more recipient ids are placed on the list. 

Avoiding Phishing Email

Phishing is a type of online fraud wherein the sender of the email tries to trick you into giving out personal information or clicking on a link as a method to try to steal your identity or your money.

• Don't send personal and financial information via email.  Banks and online stores provide, almost without exception, a secured section on their website where you can input your personal and financial information. 
• Avoid writing any company that requests that you send them private financial or personal information via email.
• Be careful when unsubscribing to newsletters you never subscribed to.  If you don't specifically remember subscribing to a newsletter, you are better off just blacklisting the email address.
• If you accidentally open a phishing email, do not reply or click on the link in the email. If you want to verify the message, manually type in the URL into your browser.

Signs of phishing include:

• A logo that looks distorted or stretched.
• Email that refers to you as "Dear Customer" or "Dear User" rather than including your actual name.
• Email that warns you that an account of yours will be shut down.
• An email threatening legal action.
• Email which comes from an account similar, but different from, the one the company usually uses.
• An email that claims 'Security Compromises' or 'Security Threats' and requires immediate action.
• Review the signature.  Legitimate businesses always provide contact details.
• The hyperlinked address is different from the address that is displayed
• The email asks you to make a donation.
• You didn't initiate the action of the email subject.

Avoiding Email Malware

• Don't always trust an email from someone you know.  Malware and viruses can be circulated by people who have no idea they are sending it, because hackers are using their computer as a zombie. 
• Blacklist spam instead of deleting it.  When you 'blacklist' an email sender, you tell your email client to assume that they are spam. 
• Don't disable the email spam filter.  
• Scan all email attachments.  Many free email clients provide an email attachment scanner built-in. You can first forward your attachments to that account before opening them.

Keeping Hackers at Bay

• Don't share your account access information with others.  
• Don't use simple and easy-to-guess passwords.  
• Encrypt your important emails.  
• Encrypt your wireless connection.  
• Use a digital signature whenever you sign an important email. 

Red flags you're about to get scammed

• Links that are the only content in the body of an email.
• Bit.ly or otherwise shortened links. 
• Hyperlinked text.
• Inordinate number of recipients.
• Vague, generic or nonexistent subject lines.
• Intense enthusiasm.
• Grammar and spelling errors.
• Strange requests.
• Urgent message.
• Sensitive information requests.
• Surefire guarantees promise.

Here are a few steps to prevent text message spam:

1. Delete text messages that ask you to confirm or provide personal information: Legitimate companies don't ask for information like your account numbers or passwords by email or text.
2. Don't reply, and don't click on links provided in the message: Links can install malware on your computer and take you to spoof sites that look real but whose purpose is to steal your information.
3. Treat your personal information like cash: Your Social Security number, credit card numbers, and bank and utility account numbers can be used to steal your money or open new accounts in your name. Don't give them out in response to a text.
4. If you are an AT&T, T-Mobile, Verizon, Sprint or Bell subscriber, you can report spam texts to your carrier by copying the original message and forwarding it to the number 7726 (SPAM), free of charge.
5. Review your cell phone bill for unauthorized charges, and report them to your carrier.
6. To block spam messages -- but not all incoming texts from friends and family -- call your carrier's customer service number (usually 611) and instruct them to "Block all text messages sent to you as email" and "Block all multimedia messages sent to you as email." You also might be able to log into your account online and activate these blocks there.
7. If dialing 611 or going into your phone settings online does not slow down spam, check with your mobile provider about other options to block future spam messages.
8. Set up and use a free email account that's only for things like promotions, contests, and the like. This way, you can easily segregate those messages from your personal and work correspondence.

More prevention tips:

1. Attacks using verification codes to bypass 2 Factor Authentication.  Be suspicious of SMS messages asking about verification codes.  Legitimate messages from password recovery services will simply tell you the verification code and will not ask you to respond in any way.
2. Don't fall for texts from your network which ask for details.  Your phone network will often text you – if you're abroad, for instance, to warn of data roaming rates. But networks won't ever ask you to confirm or verify your details. If you see a "security" text which asks for a password, or any other details, don't click the link, and don't call any numbers in it. Contact your network via their website, or via their phone number (the real one, not the one in the SMS).
3. If you see a "business" phone number in a text, it's no guarantee it's real.  Many SMS phishing attacks will include "toll free" numbers that look like legitimate business ones – they're not.
4. Don't reply with "STOP" if you're being spammed – contact your network instead.  If you're being spammed repeatedly, and the SMS contains an instruction to text back with "STOP" to cut off the emails, don't. This will simply tell the spammers that you're there, and they'll intensify their attacks. Your network will be able to block SMS from specific numbers.
5. Be very suspicious of  "special offers" – especially ones where you have to "act fast".  Phishers commonly send out SMS attacks in the form of "special offers" from big companies – such as a $1,000 gift card, where only a limited number are available, and you have to click a link to cash in.
6. High-value "special offers" that sound too good to be true usually are. If it's your local pizza place offering two-for-one on Tuesdays, you might be safer. Think first, and think hard if you're being asked to click a link.
7. Set your phone to block apps from unknown sources.  Many SMS phishing attacks aim to fool you into installing malicious apps – particularly on Android. As a precaution, block installation from unknown sources (it's in Android's Settings menu). If you have to unblock this (for instance to install a work app), set it back to "blocked" when you've finished. If you do make a mistake, this gives you another line of defense. It's also worth using Google's built-in "Verify Apps" function, which monitors apps for suspicious activity.
8. Don't fall for texts from your bank or credit union which ask for "confirmation details".  Your bank may well text you – for instance to confirm a transaction on PC – but bank texts will not, ever, ask you to confirm details, or for passwords. Banks also won't update their apps in this way. If you're suspicious, don't click links, don't call any numbers in the text. Instead, call your bank on its "normal" number – Google it if you don't know – and check whether the text is from them.
9. Don't fall for warnings saying, "Your phone is infected".  Recent SMS phishing scams use a bogus "security alert" to scare users into installing fake antivirus apps. Reputable security companies will not "push" products in this way. 
10. Don't trust caller ID.  Just because your caller ID displays a phone number or name of a legitimate company you might recognize, it doesn't guarantee the call is really coming from that number or company.

A direct-deposit phishing scheme is aimed at employers that use self-service direct-deposit platforms. These platforms allow employees to manage their W-2 and payroll options, so the platforms contain personally identifiable information (PII) as well as direct-deposit banking data.  The education sector is a popular target for this scam. 
According to the FBI, the scam begins with a phishing campaign targeting individual employees. It's a variation of sorts on the business email compromise, in which fraudsters impersonate a trusted person or a person of authority to get the victim to perform a certain action.  This can include the trusted authority of the human resources department or an HR vendor.  The email directs the employee to perform what may feel like a common transaction, like confirming a direct-deposit account, viewing changes to the account, etc.  
The goal is to get you to reveal login credentials to the fraudster, who can then use those credentials to steal PII as well as redirect the employee's deposit to another account. One of the first things the fraudster will do is change your contact email, so that you don't receive an alert.

Detecting direct-deposit scams are not much different from detecting other phishing emails:

• Spelling and grammatical errors.
• Urgent or unusual requests (often accompanied by something punitive, like an account lockout, that would result from inaction).
• Unusual or questionable sender's address (if the email is signed, also a mismatch between the sender's name in the email header and the name in the email itself).
• Embedded link that doesn't match the displayed link.
• Misleading URL (sometimes it can be as subtle a deviation as a zero instead of letter o).
• Request for personal or sensitive information.

Preventing Direct-Deposit Phishing Scams

A few steps organizations can take to prevent direct-deposit phishing scams include:

• Implement two-step or multi-factor verification for HR/payroll platforms.
• Require IT, administrators, to monitor unusual activity, such as a large number of accounts having contact and banking info changed over a short period.
• Have a policy of temporarily reverting to a paper check after a change to banking information.
• Ensure payroll login credentials are different from credentials used for other purposes.
• Set up alerts on self-service platforms for administrators so that unusual activity may be caught before money is lost. Alerts may include for when banking information is changed to online bank accounts typically used by fraudsters.
• Alert employees about the scam.
• Train employees to watch for phishing attacks and suspicious malware links. Checking the actual e-mail address rather than just looking at the display name can be crucial to spotting the attack early.
• Set a time delay between when direct deposit information is changed in the self-service portal and the actual deposit of funds into the new account to decrease the chance of the theft of funds.

What is angler phishing?
This attack is named after the anglerfish, which uses a bioluminescent lure to entice and attack smaller prey. In this case, the glowing lure is a fake customer support account that promises to help your customers but secretly steals their credentials instead.
How does it happen?
Fraudsters create highly convincing fake customer service accounts and then monitor social media channels for customer support requests. Angler phishing hackers often wait to strike on evenings or weekends when your brand is less likely to monitor social media interactions. When the hacker sees a customer contact your brand, they hijack the conversation by responding directly to that customer using their fake support page. 
Example 1: Fake customer service accounts on Twitter
Online criminals set up fake customer service accounts to phish for bank login and password information and other sensitive data. These imposter accounts look very similar to that of real businesses, but are often one character off -- or they include an extra underscore or other keyboard character.
When someone tweets at their bank or example, scam artists will intercept the conversation, and reply to that message with what seems like an authentic answer.
Let's say John Smith tweeted his request to @mybank, the hackers were able to intercept his tweet and respond using their fake account @askmybank. The link in the fraudulent response will lead John to a perfect replica of the bank's login page. There the hackers can steal his online banking credentials, ATM pin, security questions and answers, and more.
Example 2:  PayPal fraud
In this attack, an angler phisher targeted PayPal users from two fake PayPal Twitter accounts. The tweet encourages recipients to click over to the actual PayPal Twitter account, @PayPal, for assistance in an urgent matter. However, the fraudsters are monitoring the replies on the official PayPal Twitter page in order to sweep up replies to exploit for their attacks.
In addition, when victims receive a reply from the phony PayPal Twitter accounts, they're fooled again as the reply has the PayPal logo emboldened as an account image, and the handle seems official, except it amends the word "Ask" at the beginning of the handle. Targets are lured into entering their PayPal credentials into the seemingly legitimate, but fake page. The bad actors are thus provided with the personal information they need to gain access to accounts and transfer out funds held there.
Who is at risk?
Fraudulent customer support accounts are a problem for any business that provides customer service on social media. However, 2016 research from the Anti-Phishing Working Group shows that more than 75% of phishing attempts target financial service and ecommerce organizations to steal banking credentials and make fraudulent purchases.
How can I stop angler phishing attacks?
For Consumers:

• Never LOGIN to an account if the link is provided to you through email or social media.
• If you are unsure about a link in a social media post, do NOT copy and paste the link in your web browser. You could still end up at the malicious site and potentially load malware on your computer or network. If you are unsure whether a link you received in a post is safe, it is not safe to copy and paste the link in the URL section of your web browser.
• Access web sites through your web browser.  Typing the address of a web site directly into your Web browser will ensure that you are going to the legitimate Web site and not a phishing site that was designed to mimic the look of the real thing. Unless the site was hijacked or your computer has a virus, typing the web address yourself is the best way to guarantee the authenticity of a web site.
• Technology-based security measures such as firewalls, encryption, anti-virus, spam filters, and strong authentication will NOT prevent social engineering fraud. No matter how much security technology you implement, you can never get rid of the weakest link - the human factor. A social engineer is someone who uses deception, persuasion and influence to get information that would otherwise be unavailable.
• Use caution when you click links that you receive in messages from your friends on your social website. Treat links in messages on these sites as you would links in email messages. 
• Don't trust the sender information in an e-mail message. Even if the e-mail message appears to come from a sender that you know and trust, use the same precautions that you would use with any other e-mail message. Fraudsters can easily spoof the identity information in an e-mail message.
• Know the social media account handle for the company you are dealing with.  Make sure you communicate only with the legitimate account.
• Look closely at the reply you receive and be skeptical.  Look for misspelled Twitter handles, email addresses, etc.

For Businesses:
These types of attacks will be a problem for any business that provides customer service on social media. The following is a list of some key actions an organization can take to help prevent angler phishing attacks:

• Identify your organization's social media platforms, accounts and key individuals.
• Document who is responsible for the corporate accounts. These accounts should have strong passwords that are continuously being changed every few months.
• When applicable, use verified accounts. Twitter and Facebook offer an option for verified accounts to help ensure authenticity.
• Continually monitor for fraudulent accounts. Make sure you take down any suspicious activity and report it to your IT team or service provider.
• Enhance your security by leveraging email security solutions. 

One of the most sophisticated types of phishing attacks is called spear phishing. This is when a hacker will target a specific group or organization and will tailor their attacks to make them look relevant to the recipient.  When receiving emails, users should look at the following:

• Do you know the sender, and is the email address one you would expect them to use? An email purporting to be from your CEO, but sent from a Gmail account, should always ring alarm bells.
• Are you expecting a message from the person? Does the email look suspicious? Does the link look genuine?
• The content of the email can be a giveaway. One of the most basic reasons that phishing attacks work is that they prey on a user’s emotional response – fear, curiosity or reward, and emails that evoke strong emotions such as these should be considered triggers.
• Is the email specific? Does it make sense? Although criminals have a lot of information about individuals they will still keep messages generic to pique your interest, and make you take action.
• And of course, while grammar has improved in recent years, mistakes are often an indicator that all is not as it seems.

Phishing is one of the most common attack methods for cyber-criminals, however an effective training program and user awareness will minimize the risk of employees falling victim.  Once employees know what to look for they will be able to quickly identify any potential phishing emails and report them before any damage is done.