E-Mail Crooks Target Webmail Accounts

A wicked e-mail scheme uses your Webmail address--and your contact list--for scams.

Imagine having to explain an e-mail message that asks your friends for money--a message sent from your Webmail account. (Webmail refers to any e-mail service you use via a Web browser rather than through an e-mail client.) That's exactly what's happening: Scammers are breaking into such ac­­counts and, from those addresses, sending e-mail messages to the victims' entire contact list. The messages often tout a Web site (such as an e-commerce site), or even ask for money directly.

It's a new, dastardly twist on an old scam. Crooks have long used harvested addresses in the ?From:' field on junk e-mail to make messages look realistic. But because anti­spam measures have been getting better at blocking such spoofed spam, the bad guys are now breaking in and sending e-mail from actual accounts.

Maureen Arnold, a former CPA in Apache Junction, Arizona, was hit by such an attack. When she checked her MSN mail one day, she found several warnings about undeliverable messages sent from her account that she hadn't written, along with messages in her Sent box. The scam e-mail--touting a site selling electronic products--went out to her family and friends. Similar attacks have asked recipients to wire money to a particular account; some have even deleted an account's contact list afterward.

The attacks underscore an oft-ignored fact: Webmail accounts are a major target because they have value. A recent report by the Anti-Phishing Working Group says the most common types of log-ins stolen by keylogger malware are for financial Web sites, e-commerce sites, and Webmail. In addition to hijacking an e-mail account to send out messages, crooks can often glean information that helps them break into a victim's financial accounts.

So how do you keep your valuable Webmail account safe? The first step, of course, is to keep your PC clean of malware. But that isn't a complete solution: Maureen Arnold checked her PC with mul­­tiple security scanners after she discovered the break-in, and found nothing.

Another important step is to as­­sume that any public or borrowed computer that you've used to check your Webmail account was infected with a keylogger, and that your account log-in was stolen. Change your password as soon as you can on a trusted, secure computer.

Web security expert Jeremiah Grossman of WhiteHat Security identifies another point of entry: Crooks often lift Webmail account details after breaking into other sites. Many sites require your e-mail address for logging in, and many people use the same password, as well, for their log-ins to different sites.

To address this problem, take two steps: First, use a unique password for your Webmail account. Free browser tools such as Password Hash can consolidate passwords. Second, when signing up for new accounts, use a "disposable" e-mail address--something AddressGuard, a feature in the premium Yahoo Mail Plus service ($20 per year), offers. Anonymizer's Nyms service works with any e-mail account; it's also $20 per year.