Family member fell victim to a sophisticated email scam that used hidden account settings to avoid detection while stealing information.