DOOL Discussion Group

Topic: Proz--Computer Help - Forging problem

Something has come up with my brother's company e-mail that I have never heard of before.  A message supposedly written by him was sent with his name signed and he never wrote it.  Can e-mails be forged?  And How?

How do you find out where it came from?  It shows that it came from his company e-mail on the e-mail web site, which is Yahoo, but he didn't write it.  It is a small company and recently he has been using the library computers to send out his e-mail (couldn't afford to keep the Internet connection on his personal computer at this time), which means that his e-mails are sent out during the times that the library is open.  This was sent late at night and also on a night that he wasn't even around to use the computer if he could have.  Also, it is not listed in his Sent file.  There is no one else other than my brother, myself and the web site guy who knows this e-mail and password except for some former web site person who does have an separate issue with my brother but would not have known anything about what was just going on with this particular group in the company to do this as this group was formed after the former web site person left. 

The e-mail has caused some problems within a group of people causing them to quit.  He has let his current web site person know and he is looking into where this e-mail could have come from but I thought I would see what I could do to help and you were the first person I thought of that has a lot of computer knowledge. 

Any suggestions?  Whatever help you can give me I appreciate. 

Linda

It sounds like someone was just being vindictive and copied one of your brother's email messages to make it look like his. The only thing I can think of is to look at everyone's computers one at a time and see if you can see anything in the out box. It would probably cost quite a bit to put a trace on it. Oh yeah, and send out new emails saying that one was false and tell them that police have been notified (and do it).

This is a "reverse email" finder. Maybe this would help?

http://www.emailfinder.com/

Replies: (list all replies)

I thought of the copy/paste thing but when I checked into the Abuse link below that sunflowergirl listed, it said to send the message with Full Headers for them to look into. Because it came as a copy on a reply, I could not get the Full Headers. I wrote to someone on the list that I trust and that supposedly received the original forged e-mail to send me a copy of the full headers, which he did and I am forwarding that to the Abuse dept. Because he was able to send me the e-mail with Full Headers in the first place shows that it came to everyone as a regular e-mail and not a copy. That shows that someone got into my brother's e-mail to send it from there because my brother's e-mail address is listed as the return address or the ''From''. Or it seems that this is the way. I don't understand the e-mail finder page. I have everyone's e-mail address. This came from my brother's e-mail or so it says. I'll let you know what I hear from the abuse dept. ~ eom. Linda

---

Posted by: Tukey
Date posted: Sat Oct 31 15:00:10 2009
Message:

Did they look carefully at the email?  I had stalker issues last year and they had found a few websites where you can send anonymous email and make it look like it's coming from another address.  My first two clues that it wasn't really an email from my friend were 1. In the From field it came up her email address name@yahoo.com instead of her name, Jane Doe, which it would have because she is in my contacts list.  2. At the bottom of the email messages in fine print were "This email was sent using anonymousemail.com or whatever the site was called. 

Other than that, I don't know how they would log into his email without knowing or changing his password.  Hope you get to the bottom of it. 

Replies: (list all replies)

Thanks, but we can't do that. Well, not all of it. We can check out the From, which was correct, but can't check anything else, especially the bottom of the e-mail. The way we found out was that these people started quitting and sent in their resignation with a copy of that forged e-mail below their e-mail. There is nothing else other than the message that we can check. The only thing we can go by is the time, date and the way it is signed. My brother said that it isn't signed the way he would have signed such a message, plus he never would have said such things to make people quit. I guess we would have to finally gain the confidence of one of these people quitting to have them check out their e-mail as to where it came from as there is no record on his e-mail of this message to check out. ~ eom. Linda

---

Posted by: sunflowergirl
Date posted: Sat Oct 31 14:29:38 2009
Message:

I'm not sure about yahoo, but I know in hotmail there used to see the the ip address of where an email came from.  You have to turn on full headers to see all the properties of an email message.

i did a quick search and found this..  this might explain it better

http://help.yahoo.com/l/ca/yahoo/mail/spam/config-11.html

Replies: (list all replies)

Thanks. I have seen those before but never thought of it until you mentioned it. I tried it but it only displays the headers for the current e-mail and not any that are copied on there. We found this out because of this current e-mail copied the previous one sent to them, which is the forgery. That's why it isn't in the Sent file. I can suggest to this person who got the ''original'' forged e-mail to do the same and maybe they can find out. I am going to contact Yahoo to see if there is anyway we can see the headers on previous, copied e-mail. Thanks so much. ~ eom. Linda

---

---