This is an automated archive made by the Lemmit Bot.

The original was posted on /r/tifu by /u/Own_Ad_7614 on 2026-08-13 00:28:23+00:00.

I’m a school student approaching my Junior year, and today, i checked my school email to the realization my German teacher had emailed Me.

The email included a hyperlink that was regarded to as some type of ‘invoice’; in retrospect it was clearly a shady link. However, I disregarded that concern, as i was confused for another reason: I shouldn’t be contacted because I was not on the roster for German the following year. My immediate thought was that there was some confusion since my teacher was MIA for the last few weeks of school regarding personal issues. I thought the link involved attendance and so clicked on it seeing what I could do to resolve any issues.

In this brief window where my mind turned off critical thinking, I had entered my email and password into the default google pop-up, like you might expect when you log into your browser. The second I had sent my password I realized my mistake.

I first attempted to change my password; however, school accounts on devices outside the school property cannot do that. I didn‘t know what to do so I moved on for a period of 10 minutes before deciding to delete some of my saved passwords on the account. I then checked my email’s trash and was immediately horrified. I had sent an email to about 100-150 people, ostensibly those who I had sent emails to in the past, many of which were from the school. The email also included another link, though fortunately the email was ‘signed’ at the bottom with the superintendents information rather than my own.

Thankfully, I contacted some of my friends who were in the list, and apparently google had not sent the email due to the suspicious activity. I sent a preemptive email clarifying that my account was compromised as well.

Unfortunately, the situation only escalated. The person responsible had realized there was another set of contacts they could exploit: those who had school emails. They proceeded to email EVERYONE under the school email on my account with another scam link. There were emails sent that spanned the entire school system going alphabetically. I only realized this because I started getting responses from students asking about the alleged ‘invoice’.

With the help of my friend I was able to activate 2 factor authentication on my phone and kick the foreign window devices off my account. Apparently, the windows device was from Cape Town, South Africa. Afterwards i sent the same clarification/ alert email to the rest of the people messaged(hundreds if not thousands).

So far no more emails have been sent on my account, but I’ve been stressed nearly to the point of hysterics at points. I’m going to contact my schools office tomorrow to see if I can change my password just in case as they have limited windows of contact(as observed by the many automated emails alarming me of ‘vacations’ attended to by school staff). Also, the aforesaid friend is trying to hack them back.

TLDR; I accidentally provided a hacker with my school account information by interacting with a message from a former teacher, and then said hacker disseminated the scam link to my entire school via my account.