Truthfully, it is extremely rare that an account is actually "hacked" in the conventional sense of the word. What is vastly more likely is that the account was "phished," meaning that they victim was lead to a logon page that looked almost exactly identical to the page they were accustomed to, and they input their username and password on this page. As soon as that happens, it takes the automated programs moments to take control of your account on the real site that the phishing site was meant to imitate.
So... now you know the threat. Let's go over a few easy ways to keep yourself from being victimized by phishers:
"ACH Transfer Declined"
"IRS Transfer Declined"
"Your Craigslist account has been suspended."
etc.
Many times, they will ask you to reply to the email with your username and password. I'll put this as subtly as I can: NEVER EMAIL ANY SERVICE PROVIDER YOUR PASSWORD, EVER! THEY WILL NEVER ASK FOR IT BY EMAIL IF THEY ARE LEGITIMATE.... excuse me... Sorry for the caps, but that bit is really important.
The URL in the top bar of the page should match exactly the website you are trying to log into... ie: If you are trying to log into www.chase.com, and the URL bar says www.mychase1.com, it is a fraud, and you need to back out of that page as quickly as possible.
The green https: (secure) indicator at the top left of the address bar is a good indicator that you are safe.

