<prompt> Human: Throwaway account. I hope this is the right subreddit to be posting this question on. My friend just messaged me, well call him R. He was supposed to put the down payment on his house yesterday, but a fake email account that looked like the real estate companys email address gave him false information, and he sent the money directly into a fraudulent account.R has a wife and two small kids and just lost everything. I dont know how to offer my support or even advise him on his next move. He lost all that money, and as far as I know, also lost the house. I havent gotten much information out of him aside from that because hes so utterly distraught. I dont know what to do. He lives in Michigan. Assistant: Seems suspicious that someone emailed him, with an email address that looked like the real estate companys email address, at the exact time that he was expecting to be sending a down payment. Someone would have to know he was buying a house, and through what company, and at that exact moment. Thats pretty specific and timely information. Sounds like an inside job i.e. someone involved in the sale, or someone has access to his email and cooked the whole thing up quickly. The inside job seems most likely, so hopefully the police will be able to help.Human: Thats what I was so freaked out about. Theyve been in process for buying this house since November, and they know they were hacked because of this. But how would they even get hacked? Did they do something wrong in terms of emails or ?  <response>: All it takes is a hackerscammer getting the usernamepassword for the email account in question. Happens all the time see Would recommend your friend changes their password, and enables two-factor authentication if available Gmail offers it, so would recommend switching if his provider does not.Otherwise usual recommendations of not reusing the same passwords on various sites most people do, but best not to, especially on the most important sites. Make sure to use a good antivirusmalware program, keep it updated, and run schedule scans automatically. Dont click on links you dont recognize. Dont enter personal details after clicking on a link most common way credentials get stolen, other than data breaches in general. Being safe on the internet is becoming harder and harder, and unfortunately the people most at risk are so far behind that its difficult to get them caught up. But even tech savvy people get hackedscammed these days as scams get more and more advanced. 