How to find out if your Google account has been hacked
I’m focusing on Google (Gmail, Google Docs, etc.) because of its popularity with users. This post is about security: Have you been hacked?
How do you know?
Recently, a client called me and said that he had a
virus. Emails were going out in his name asking for financial information. He
assumed his computer had a virus that attacked his account with the goal of stealing personal information from his clients -- a practice known as phishing.
In fact, it was his web-based Gmail account that had been hacked, not his actual computer.
We don’t know how, but someone had acquired his Gmail password and accessed his email account. That is bad enough, but once in his email account, the hacker can access any passwords you may have saved in your account, knowingly or unknowingly. To see if you have any unsecured passwords, try this simple exercise: Open Gmail and type password in the search field. If you are like me, your results will uncover some passwords you thought were secure.
Think about this: If the hackers have your password for Netflix, there’s a
good chance they have the password for your bank. Even if they don’t have that, they have gained insight into how you create your passwords.
In this particular case, I logged into his account while the hacker was attempting to access his information. I was able to shut them down by changing the password before they could do some real damage.
Gmail provides some great tools to protect yourself from this. If you go into your recent activity page, you can see from which locations (geographically) your account has been accessed.
How to access the Recent Activity screen in Gmail:
- Go to Gmail.com
- Click on your account name
- Click on “Privacy”
- Click on the arrow by “Security”
- Select “Recent Activity”
- If you see a login from somewhere other than where you are, you've been potentially hacked.
- If so, immediately change your password using the link at the top of the page. This will stop the hacker from accessing your account.
Regardless of whether or not you have been hacked or which email service or client you use, try this short exercise:
1. Go to the search bar in your email and type password, then click search.
2. Take a look at the emails it finds looking for password resets and others like that.
3. Open them up and see if your password is displayed anywhere.
4. If so, delete the the email and empty your trash folder.
Below is an example of one I found in my inbox:
If you are very security conscious, you vary your passwords across all the sites you use. If you are like most everyone else, you have one or two you use on every site because it's hard to remember many different ones.This is a topic for another day, but there are password managers that can secure various passwords, allowing you to access them through one master password. That way you only have to remember one (very secure) password. I use and recommend LastPass (www.lastpass.com), but there are others that are very good as well.
Please, feel free to ask questions or post comments. The more I get, the more we can learn.
See you in the ether.
Bud
