Helping a friend via phone (not in person) on this.

So many related parties received the classic phishing email, "Sorry to ask, do you have a free moment over email? Please let me know! " from this person, and judging from the phone calls, quite a few have fallen for this already!!!

i.e. reported to them that friends received call from the warehouse assuming for gift card purchases etc.

I've looked at the source of the email and it looks like any other xtra email, mailed using Open-Xchange Mailer v7.10.6-Rev67

Assuming this is all spoofed using database from past hacks and they are being targeted.

We went through with them what emails have you recently view and links clicked etc, and only thing that came up was they thought they received an email from spark (or xtra) that mentioned something about being with them for a long time and program needs updating, and they clicked on an update button that did nothing. Which to me is a red flag.

They assure me no passwords etc were passed over.

The question is, has their xtra email account password been hacked or all 100% just been spoofed?

What would be the best advice here?

 

1. Reset iphone / ipad?
2. Change xtra account password
3. Def call the bank and reset details there
4. Change email address as guessing they will be on the target list

Thanks