What to do if you have been hacked
Fred Cook didn’t know someone was using his email to ask friends and families for favors until his daughter Ashley wrote him back.
“Dad, you have been hacked,” she typed, alerting the 78-yearold northwest Houston resident about the questionable emails someone had been sending from his email address.
That set off a three week-long goose chase where Cook and three of his children scrambled to keep an unidentified hacker from intercepting his emails, calls and texts; transferring cash from his accounts to unknown PayPal users and tracking his every move.
“I’ve been through thick and thin,” he said, “and I don’t think I’ve ever felt as violated as I was here.”
Here’s how to identify if you’ve been a victim of a scam and what to do if you’ve been hacked.
What is identity theft?
As a crime, identity theft is when someone steals personal information, usually to create financial accounts in the victim’s name, said Richard Alderman, a University of Houston law professor emeritus who studies fraud and scams. But these days, it’s more of a blanket term for financial cybercrime.
The scams are getting more sophisticated, but they’re also preying on current events to grab credit card numbers and personal information, said Keith Houston, a Harris County prosecutor
who studies fraud.
“What’s happening right now is a harvest of personal information on the web,” Houston said.
People are losing their money and credit card information to scams to buy surgical masks and check cashing. The Federal Trade Commission offers a few clues into whether you may have been a victim of identity theft or other fraud: There are unexplained charges on your bank or credit card statements Debt collectors call about debts you haven’t incurred Your credit report shows accounts you never created
Who hacked me?
To this day, Cook does not know who obtained his email and password. But it might be helpful to run your email addresses through haveibeenpwned.com, an independent website that compares your information to known database leaks. The site also has a separate page to test a password and see if it has been exposed in a data breach.
Services like Netflix and Gmail also offer pages for users to see who has recently logged onto an account.
Sometimes, you’ll be able to trace a suspect’s internet protocol (IP) address — where they’re accessing your account from — and be able to report it to the authorities.
Although the Harris County District Attorney’s Office sees a large number of victims 55 and older, scammers will go after everyone.
“No one’s immune to this,” Houston said.
Where do I report the crime?
Investigators are more likely to catch the culprit if there’s a paper trail, Houston said. Harris County and Houston law enforcement agencies have dedicated cybercrime units that trace hackers.
You can call the Houston Police Department Financial
Crimes Unit at 713-308-2500 if you think you’ve been a victim of fraud or identity theft. The Harris County Sheriff ’s Office’s Financial Crimes Unit is at 713-9675770.
You should also report any breaches or hacking incidents to the FBI at IC3.gov, which tracks fraud and cybercrime nationwide.
How do I lock down my personal information?
It’s a time-consuming task, Alderman warned.
“You have to contact all the entities that you have accounts with that could be hacked like this and get their assistance,” he said.
To add an extra layer of security to prevent theft and fraud, avoid using the same username and password on all of your accounts. Mix it up, or use a password generator.
Set up two-factor authentication on any accounts that have them. That’s when you’re required to enter a randomly generated passcode in addition to your password to gain access to your account — especially crucial if you’re logging in on a financial institution’s website, or anything else with sensitive information.
Cybersecurity experts consider authenticating apps like Google Authenticator and Microsoft Authenticator as more secure options. Hackers will have a much harder time trying to intercept the codes randomly generated by an app on a phone.
If you have a smartphone, you should also lock down your SIM card to prevent SIM-jacking, when a hacker tries to get a phone carrier to transfer your number to a new SIM card, therefore intercepting all the phone codes for two-factor authentication systems.
You can pre-empt that by calling your phone carrier and askingto place a PIN on your SIM card, or setting a PIN from your smartphone settings.
What are steps I can take to reclaim my financial information if I’ve been hacked?
Start by requesting a free credit report from one of the three major credit reporting agencies (Experian, TransUnion and Equifax) at annualcreditreports.com to see what accounts are open.
Fraud experts recommend putting an alert or freeze on your credit report, depending on which you need. An alert lets financial institutions know something fishy recently happened; a freeze bars anyone from opening new accounts, which could be problematic if you need credit soon to get a mortgage or apply for a rental.
It was an exhausting month for Cook during the global pandemic. He and his two sons spent a 10-hour day calling financial institutions, changing passwords and replacing his phone number and email address.
“Financially, I came through with no scars,” Cook said. “Mentally, it’s been a real experience.”