New social engineering attack tricks you into giving away access to your own account. Here’s what you need to know and do.