Hacker News Reader

Comment by lupire | Hacker News Reader

sending email to a address controlled by a hacker isn't super effective.

My email was hacked and the attacker used that to reset my Delta password to clear out my points to use on the marketplace where you could exchange them for gift cards.

What's interesting is that they logged into my webmail to create rules to forward all mail from Delta to trash so that I wouldn't see any of the notifications.

If your only method of contacting your customer is via email and the email is demonstrably controlled by a hacker then you have a hacker for a customer.

If email isn't your only method of contacting your customer... then sending an email to an address controlled by a hacker isn't your only option.

> If your only method of contacting your customer is via email and the email is demonstrably controlled by a hacker then you have a hacker for a customer.

That's obviously false. The context of this very discussion is that more than one person is able to log into an account for many email accounts.

A previous comment mentioned the hackers setting up rules to automatically delete messages that would inform the user they were hacked.

Sure but the hacker can trash the email.

Thanks for agreeing.

It seems like they tend to not change the account password. If anything, changing the password could be counterproductive because they seem to want access to look for stuff more than exclusive control. the longer they have access more likely they are to find something valuable.

In terms of notifying them, I think an email would be appropriate, although straight up saying that the customer's account has been compromised might not be the best idea because the hacker could update their software to look for that. It might be better to send an email about some billing issue, and when the customer calls then explain to them that their account has been comprimised.

Whatever wording they chose, if any major email provider they went down this route hackers would learn to identify these emails soon enough and automatically delete them from compromised accounts

If the server software were smart, it could consider certain emails undeletable for 7 days.

I often wonder why Gmail 'Suspicious login' emails aren't like this.

They could. The success of that approach would vary though. The email provider could look for that too and resend the email. They could also disallow rules that block emails from them in this case.

The user could also get the email on their device if the hacker doesn't delete it quickly, which is a possibility given the low and slow nature of this scheme.

Reply on news.ycombinator.com