Beware the hackers who take over your Gmail account

Your friend emails you from holiday saying he's been mugged and could you urgently wire him cash? But it's a scam – hackers are controlling his Gmail

• Rupert Jones and Patrick Collinson

Are you sure scammers are not watching your Gmail account? Photograph: Dominic Lipinski/PA

Here at Guardian Money we've seen pretty much every scam email going. There are the "phishing" ones that purport to come from your bank; the ones saying you're due a tax refund; the "you've won the lottery" ones; and, of course, the ones from wealthy foreigners in Africa who need help moving squillions of dollars out of the country.
However, the email we received recently from Ned Beale, a solicitor who wrote a series of articles for Money two years ago, stopped us in our tracks. It said Beale had been robbed during a trip to Athens – all his belongings were stolen at gunpoint, and he was desperate for help.
"It's a terrible experience for me. I need your help flying back home as I am trying to raise some money. I have made contact with my bank but the best they can do is to mail me a new card which will take two to four days to arrive here. I need you to lend me money, will pay back once I get this over with," said the email. It went on to say that Western Union was the fastest option for wiring funds. "Let me know if you need my details (full names/location) to effect a transfer. You can reach me via email [a "ymail" address in his name] or the hotel's desk phone 0030 698 083 7647. Thanks, Ned Beale."
Our immediate reaction was: poor Ned – what a nightmare. But something smelled fishy. The email address was indeed his, but the use of the word "cellphone" jarred slightly, and surely there would be other more obvious candidates to help – close friends, relatives, work colleagues etc – than us? We have to admit that we did nothing.
You will have realised by now this was a scam – albeit one of the most convincing we have encountered. It's a nasty one, too. As well as hacking into people's accounts to send out the fake message, the fraudster deletes every one of their victim's emails and contacts, presumably to stop them quickly getting hold of their contacts to tell them to ignore the previous message.
Beale wasn't the only victim of this hi-tech hacking attack. Far from it. Up and down the country, people with Google email accounts have been affected by this scam, which is a little more persuasive than it might be as a result of coinciding with the summer holidays, when it is perfectly plausible that someone might be visiting Greece.
Beale, of course, hadn't been to Athens and hadn't been robbed. "Some people did believe it," he told Money. "It went to everybody in my Gmail account. I was sitting in the Royal Courts of Justice when I got a call from my secretary saying 'come back to the office - all these people are ringing us asking if you're OK'."
While he could access his account, everything had been deleted, "so there was no way for me to send an email to everyone to say that it was fake".
The scam email asks people to get in touch with the "sender" via a "ymail" account that is almost identical to their Gmail address. "Apparently the hacker started corresponding with people, trying to get money out of them," says Beale. "I think some people actually spoke to him on the phone."
In some of his emails, the crook – rather carelessly – signed himself as "Keith". As far as Beale is aware, no one has handed over any money.
Beale, who has now changed all his passwords, has no idea why he was targeted - "I was assuming they have some sort of computer programme".
It doesn't sound as if Google was much help. Beale says: "I tried to get hold of Google [but] you're not able to. They don't have a number or email address."
Chris Corrigan, a newspaper sub-editor, is another victim of the "mugged in Athens" email. The email sent in his name was identical to the one sent in Beale's name – even down to the same "hotel" phone number. Corrigan, who lives in south London, says he was surprised at how many people were nearly taken in by it.
The fake email was sent to an array of people, "from family and friends and contacts, to people who used to mend my car in 2009, a solicitor from two years back etc". The scammers then deleted all the addresses from his Gmail account – both his inbox and sent mail – about 2,000 messages.
Corrigan thinks he might have an idea how it all started. "Several weeks previously I'd received emails from two friends containing nothing in the way of a usual greeting, just a nondescript link to click on. With one of them, I stupidly did click on the link but nothing coherent happened. I phoned the friend, who said he hadn't sent me a message."
He says that after the scam came to light he looked in his Googlemail settings and found a ymail.com address as well as his own Gmail.com address. "The ymail.com address was forwarding all my mail to somewhere else and was central to the scam. I didn't put it there. I've since killed it, but is my computer still infected? I don't know. The experience caused turmoil for a lot of people. Many fear their own email accounts have been infected. As for me, it has caused electronic havoc because I have lost two years' records of various conversations, including a large number important to my work."
It didn't take long for Money to find other recent examples of people who have been hit. A former Guardian Money writer, now living in the US, was a recent victim. Lynne Bateson's Gmail address was hacked and a desperate request for help sent to all her contacts. It said: "I'm writing this mail with tears in my eye. I came to London, England, on a vacation, unfortunately I got mugged at the park of the hotel I lodged, all my cash, credit card and telephone were stolen from me but luckily for me I still have my travel passports with me. I am in panic now and I don't know what to do."
Lynne Bateson, whose email account was hacked. Bateson, who now lives in Pasadena, California, says: "In one fell swoop the scam reminded me how wonderful and also how daft people are. I was woken up at 6.01am Californian time by a guy from a pension company telling me he could not release funds. The calls then came thick and fast.
"One very high-powered UK-based executive called my US number. He had been alarmed and had cash ready and was going to hop in a taxi, but then thought he should ring our US home first. One US friend even rang the Department of Homeland Security!
"My lovely US doctor and US bank manager rang. They had embryonic plans to help. The doctor is Russian and the bank manager Chinese so maybe they did not notice the terrible grammar in the same letter. (I do hope they don't think that is how I write.) But this underlines an interesting point. It is helpful to scammers that we are an increasingly multi-cultural world where people communicate in a language not their first language."
Bateson says that some friends were alarmed to get the email and were anxious that their own emails might have been compromised. "People did not want to email me. I don't think anyone was fooled but if the email had gone to an elderly relative …"
She adds: "The scammers stole my emails, which meant I lost many contact addresses, and it was fiddly to reopen my Gmail account. My Facebook account was also closed down despite the fact that I had different passwords for Gmail and Facebook and always made sure I did not enter the second directly from the first. (Some scammers use software that monitors your keystrokes).
"Thankfully, I had a secondary email account which meant that I had a line of communication with Google and Facebook. You can't phone these guys and website advice is difficult to follow particularly when you are stressed.
After her experience Bateson says she would advise everyone to get a secondary email account. "I would also advise people that when their emails are up and running again to check what happens to the emails they send when they hit respond. Mine were still going to the scammers. I had to change the settings, which had been reconfigured by the scammers. And keep a printout of email addresses."
We asked Google for a response and a spokesman replied: "We take these issues very seriously, but it's important to remember that these do not represent hacking attempts on the Gmail service directly. Account hijacking often occurs due to issues with phishing and malware, or when users reuse their email password with another site that becomes compromised.
"We communicate regularly with users about account security topics, and we develop technologies like our suspicious account activity alert to help protect user accounts. As always, we recommend users follow good account security hygiene, including enabling features like 2-step verification."
Google recommends that all users follow its Gmail security checklist.