Hacked!

By Margaret Lucke

Connections with friends and family, facts at your fingertips, movies, puzzles, games (I’m looking at you, New York Times Spelling Bee). The internet, email, and other forms of modern technology have many benefits to offer. Maybe even AI does, though the jury is still out on that one, if you ask me.

But there are downsides too, and I experienced one of those the other day when my professional author email address got hacked.

The first hint of the disaster came a week ago Friday in the form of a phone call from a friend—I’ll call her Grace—who is on the mailing list for my newsletter. She said, “I got an email from you about needing money from a workshop. I responded to it saying I’d be happy to contribute, but the next message asked me to send the money directly to ‘him’ via Venmo. The him made me suspicious, so I thought I’d check. Was this request really from you?”

 Well, it most certainly was not from me. I asked Grace to forward the email exchange to me, which she did.

Turned out the request for money was tacked onto a brief exchange of emails we had when she sent a compliment in response to my August 2024 email, using the pro address. The new (fake) message, sent on June 6, 2026, said: “Could you please email me back when you receive this.” So she did, replying with a one-line message along the lines of “Sure, what’s up?”

That triggered a long, plaintive, tear-jerk of a message that said, in part: “I’m in a really tight spot with the Writers Workshop & Fundraiser I’ve been pouring my heart into” and “I wouldn’t reach out like this if it weren’t truly urgent. The full payment has to be made before Monday, or I risk losing the space and with it, months of preparation, energy, and resources I’ve already invested” and “If you’re able to support me in any way, it would mean more than I can express. This project is deeply personal to me, and I’m doing everything I can to keep it from slipping away at the last moment.”

None of which is true.

After my conversation with Grace, I started hearing from others who had received similar emails that purported to be from me. One friend reported that after she responded to the “Could you please email me back when you receive this” message, she received a request in my name that she support a political candidate whom she knows I oppose.

It was time to take action.

I tried to log into my pro email account, which is attached to my website. My password wouldn’t work. When I tried to change it, I was asked to enter an authentication code that I never received. So I initiated an online chat with the provider of my website and pro email address. I went around and around with an AI bot, which kept suggesting I try generic solutions, none of which helped. Finally I convinced the bot that I needed to deal with a real human being. With that person’s help I was able to set a new password and new two-factor authentication.

Hopefully the problem is now resolved. What I’ve lost is a lot of time, all of the emails that were in my now-empty inbox and sent file, and perhaps some goodwill.

I sent out an emergency email to my newsletter list, just in case, warning my subscribers about the hack. But for the newsletter I use a mailing service. Those individuals’ addresses weren’t in my pro email records except for the few who had gotten in touch with me that way.  

One little suspicious thing: I had spent the previous Sunday at the Bay Area Book Festival, signing and schmoozing at the Bay Area Romance Writers booth. I pleased to collect three new subscribers for my newsletter and I had pleasant chats with everyone who signed up. Later, when I sent them my standard welcome email, I included a new tagline that I hadn’t used before. Interestingly, that tagline was used on the spam emails sent in my name. I’m not quite sure what to make of that.

The whole experience has left me shaken. And frustrated. And angry. And confused.

So if anyone reading this post receives an email from me that makes a plea for money or asks you to support a politician—or even one that just says: “Could you please email me back when you receive this”—please let me know it happened so I can figure out the next steps I need to take. Your next step is to not respond and put it in your trash or your junk/spam folder. And please be cautious. The scamsters are out there and they want your funds badly enough to steal them.