Harrowing story of an identity theft victim.
Yes, the person made a mistake—they gave the scammer a two-factor authentication code that allowed the scammer to take over their email address. But the real story here is how, for many of us, the security of most of our accounts hangs on the security of our email accounts.
Billy Jack • July 22, 2026 8:02 AM
I received an e-mail last night from a former customer of mine. The only explanation I can think of is that he or his wife gave out their gmail address and password to someone spoofing something called paperlesspost.
I got his telephone number from one of the early morning coffee drinkers a few minutes ago and am getting ready to call him to warn him and suggest that he contact his bank and credit card companies and that he should probably start changing passwords. If I can’t get hold of him, I’ll probably drive out to his house in a bit to talk to him in person.
It would surprise me if he didn’t use the same weak password on everything.
Subscribe to comments on this entry
Sidebar photo of Bruce Schneier by Joe MacInnis.
Doug • July 22, 2026 7:54 AM
I read articles like this and shudder. I’m married and nearly all of our financial accounts are shared. Trying to figure out a security schema that works for two people who have vastly different understandings of security and risk is not trivial.