How to determine whether an email is a spoof or whether the email account has been hacked into.9

Now Then
Now Then used Ask the Experts™
on
My brother-in-law has forwarded an email conversation to me that was initiated by a request for the payment of an invoice that did not exist. The spam email appears to have come from his email address and was sent to people in his address book. I was wondering if someone could help me to recognise whether the spam email is a spoof or whether someone or something has managed to hack into the email account. I have no real experience of reading email headers so please be gentle.
Thank you in advance.
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Andrew LeniartIT Professional | Freelance Journalist | Looking for Opportunities
Distinguished Expert 2018

Commented:
My brother-in-law has forwarded an email conversation to me that was initiated by a request for the payment of an invoice that did not exist.
I frequently see these myself. They are scam emails sent in the hope that some lowly paid accounts payable clerk at a company (or the owner himself) will just assume the invoice is valid and pay it.

I was wondering if someone could help me to recognise whether the spam email is a spoof or whether someone or something has managed to hack into the email account. I have no real experience of reading email headers so please be gentle.
Who are the participating authors of this conversation? Does he recognize any of them? It's highly unlikely anyone has managed to hack into your brother-in-laws email account just because he got an email like this. A hacked account would almost certainly have other indications of unauthorized use.

If you want to be on the safe side, advise your brother in law to change his email account password and ensure his account recovery options are valid.

I hope that's helpful.

Regards, Andrew
Now ThenNot applicable

Author

Commented:
The spam email purports to have come from my brother-in-law. It has been sent to people in his address book.
Top Expert 2016

Commented:
really without the headers there isn't much anyone can do from afar. you could try pasting the header into https://mxtoolbox.com/EmailHeaders.aspx
Ensure you’re charging the right price for your IT

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!

Now ThenNot applicable

Author

Commented:
Are the email headers from the original email still visible when the email has been forwarded?
Andrew LeniartIT Professional | Freelance Journalist | Looking for Opportunities
Distinguished Expert 2018

Commented:
Yes, if an email has been forwarded, the original email headers should remain. If you could tell us which email client are you using, we can help in how to extract the email headers.
IT Professional | Freelance Journalist | Looking for Opportunities
Distinguished Expert 2018
Commented:
The spam email purports to have come from my brother-in-law. It has been sent to people in his address book.
That's a different story. Getting an email from himself is a common spoof tactic used by scammers, but if his address book has been compromised, then he either has malware on his computer or someone has accessed his email account online and taken a copy of any contacts saved there.

Recommend you tell him to download, install and run MalwareBytes anti-malware (the free version is fine) and also change his email password and recovery options as mentioned before. Ensure no malware is on his computer before changing password though in case there is a keylogger on his system.
Now ThenNot applicable

Author

Commented:
Well, it seems that forwarded emails do not contain the headers from the original email. I am waiting now for someone to provide me with the original headers. That could take a while.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial