Forgot your password?
typodupeerror
Security Crime Privacy

Ask Slashdot: Identity Theft Attempt In Progress; How To Respond? 239

Posted by timothy
from the burrs-on-the-heel-of-the-foot-would-be-mercy dept.
An anonymous reader writes "It appears that two weeks ago my email address got into the wrong database. Since that time there have been continuing attempts to access my accounts and create new accounts in my name. I have received emails asking me to click the link below to confirm I want to create an account with Twitter, Facebook, Apple Games Center, Facebook mobile account, and numerous pornographic sites. I have not attempted to create accounts on any of these services. I have also received 16 notices from Apple about how to reset my Apple ID. I am guessing these notices are being automatically generated in response to too many failed login attempts. At this point I have no reason to believe any of my accounts have been compromised but I see no good response."
This discussion has been archived. No new comments can be posted.

Ask Slashdot: Identity Theft Attempt In Progress; How To Respond?

Comments Filter:
  • by alen (225700) on Tuesday February 26, 2013 @02:44PM (#43016735)

    to something not in the dictionary?

    after that i would just ignore the failed attempts. after a while the perp will stop and move on to easier prey

  • by X0563511 (793323) on Tuesday February 26, 2013 @02:57PM (#43016887) Homepage Journal

    foo.bar and foobar (and f.o.o.ba.r) are all the same account as far as gmail is concerned. The dots are dropped.

  • by Bearhouse (1034238) on Tuesday February 26, 2013 @02:59PM (#43016935)

    Indeed. Keep the old ones, of course, but change the passwords to something very, very secure and different for each one.
    Backup then delete all information associated in the Cloud with these addresses, (Android, iCloud, Gdrive...)

    Do not reuse any of the old accounts for anything. Use a "one-time" account for verification each of the new accounts, then nuke it and change to a new one.
    Do not be tempted to have one master account for verification of all the child ones.
    If you're using gmail, or similar, do NOT use some variation of your name, home town, company, whatever.

    Finally, pony up for your own domain etc. and get a nice email account you can totally control. Cheap, too.

  • by Anonymous Coward on Tuesday February 26, 2013 @03:01PM (#43016965)

    Yes... but fubar@gmail.COM is NOT the same as foobar@gmail.AU. Reread the parent.

  • by AK Marc (707885) on Tuesday February 26, 2013 @03:03PM (#43016975)
    You can change your passwords on every site to different random strings of unbreakable length and store them in a password manager, to guarantee that breaking one wouldn't affect the others.

    Or you can attempt to close any accounts tied to that email.

    Other than closing the accounts, there's nothing you can do. I've called the FBI in a similar circumstance. "Yes, we are tasked with enforcement of that nature. No, we will not act unless you've suffered actual monetary loss."

    If you want to prevent this, use different email accounts for each service (you can forward them all to the same "main" account to make checking them easier), so if one email gets abused, you only risk one service. But that's too late for the submitter.
  • Chill out... (Score:5, Informative)

    by bazmail (764941) on Tuesday February 26, 2013 @03:04PM (#43016981)
    It is just someone who doesn't like you trying to fuck with you. That's not how identity thieves operate. Hopefully one of those automated emails sent you you includes an IP address of whomever is submitting the forms, and that may lead to something. I would say relax, it will pass.
  • by zerosomething (1353609) on Tuesday February 26, 2013 @03:05PM (#43016995) Homepage

    Found some old recommendations I sent out to friends that weren't too tek savvy. It's fairly basic info that most should know.

    I was looking into Life Lock and started reading what they actually do, which is in the fine print of their terms of service here.

    http://www.dmachoice.org/ [dmachoice.org] it's the primary service Life Lock uses to get you off of mailing lists and it's free. They also have some good info on how to keep secure online. There are several items you can go through to have your self removed form email and mail lists.

    Then go to https://www.donotcall.gov/ [donotcall.gov] and register your phone numbers for the do not call list.

    Then go to https://www.optoutprescreen.com/ [optoutprescreen.com] to remove your self from the credit card pre-approval lists.

    If you want free credit reports use this site. https://www.annualcreditreport.com/cra/index.jsp [annualcreditreport.com] You can get 1 free report every year from each of the 3 reporting agencies. If you break it up you could get 1 every 2 month. I could get one from Equifax this month. Then in 2 months my wife could get one for them. Then in 2 months I could get one from TransUnion. etc... The reason to get them is mostly to see who has been looking at your credit. Then make sure all the loans are yours.

    Now for your online stuff. Get an email account at google or some place else that you can use for those online registration things that you need to do from time to time. Use that account only for things that you are unsure about. Keep another account for the more important stuff like the banks. You could even have a 3rd account for your general email.

    Most web browsers have an option too clear the cache and cookies. Look for it. In Safari on Mac look under the Safari menu then select Reset Safari... On Windows it's under the File Menu. In Firefox you need to look in the Preferences and the Security tab. Resetting and clearing out the cookies will also clear saved passwords. The reason to do this is because many web sites set tokens on your web browser called cookies that allow them to track you and what you do online. They can see where you are going and what you do online. For Windows this is a big problem because there are ways to install applications on the system without you knowing. Then your computer can be used to send email spam to others or even be used remotely to take over other computers. This is really only a problem on Windows but for Macs they can still track your online usage and figure things out about you that might make it easier to get you to click on something that would install an application that could take over your computer.

    For email. Set your email program to not automatically read your mail and try to use the built-in spam filters. Also set the options to not download in-line pictures and such. The pictures in spam can be used to also track you and verify your email address. If you and I get the same piece of spam the picture will actually not be in the email it's actually a picture on a web server someplace. The name of the picture is unique to each spam email so when your mail program tries to access the picture from the internet the spammers computer ticks off the unique name your computer used to get the picture. That unique name is associated with your email address.

  • by Geoffrey.landis (926948) on Tuesday February 26, 2013 @03:09PM (#43017047) Homepage

    With the 3 main credit agencies, definitely put a credit fraud alert on your account

    Do be aware that the mere act of putting a credit fraud alert on your file with the credit agencies will reduce your credit rating, and result in banks quoting you higher interest rates if you apply for a loan.

  • by Anonymous Coward on Tuesday February 26, 2013 @03:09PM (#43017055)

    I've been down this road.. The local police are likely to tell you unless you are under threat of imminent bodily harm, you should contact the FBI. When you contact the FBI, they will tell you computers get viruses all the time and you should ignore the problem or contact your local police if you feel your life is in danger.

    I'm not trolling or being sarcastic. This was what actually happened when I contact LEOs to try and help solve the problem. Like others said, change your email address and get on with your life. Unless you want to spend a bunch of time chasing ghosts on your own time.

  • by rgbrenner (317308) on Tuesday February 26, 2013 @03:47PM (#43017493)

    Good call on posting your BS as an AC.

    Google Help: Receiving someone else's mail
    http://support.google.com/mail/bin/answer.py?hl=en&answer=10313 [google.com]

    Gmail doesn't recognize dots as characters within usernames, you can add or remove the dots from a Gmail address without changing the actual destination address; they'll all go to your inbox, and only yours. In short:

    homerjsimpson@gmail.com = hom.er.j.sim.ps.on@gmail.com
    homerjsimpson@gmail.com = HOMERJSIMPSON@gmail.com
    homerjsimpson@gmail.com = Homer.J.Simpson@gmail.com

    All these addresses belong to the same person. You can see this if you try to sign in with your username, but adding or removing a dot from it. You'll still go to your account.

  • by PickyH3D (680158) on Tuesday February 26, 2013 @05:17PM (#43018413)

    That wasn't originally the case though. I believe that when they first instituted the referenced change, they excepted those that were already in conflict.

  • by Technician (215283) on Tuesday February 26, 2013 @05:20PM (#43018445)

    For part of your paper trail, look at the lower right corner of Gmail. I bad guys were in your account recently, you may find some evidence on the "Last account activity: 13 hours ago
    Details".. Click on the Details link and it will open your most recent login times and IP addresses. If you were not on a trip and you were logged in from Florida or somewhere else, it is time to save the info and change your password. Knowing the IP adderess of someone using your account is good evidence. Contact their ISP with time, date, timezone, with the info. It may be against his ISP's terms of service to hack from his account. For those without Gmail, this is what it looks like. Note IP addresses altered to protect my privacy. I checked my mail from work, home, and on a recent trip.
    Browser * United States (WA) (192.25.69.00) 1:11 pm (4 minutes ago)
    Browser United States (OR) (10.134.137.00) Feb 25 (13 hours ago)
    Browser United States (WA) (192.25.69.00) Feb 25 (20 hours ago)
    Browser United States (WA) (192.25.69.00) Feb 25 (20 hours ago)
    Browser United States (WA) (192.25.69.00) Feb 23 (3 days ago)
    Browser United States (OR) (127.34.103.00) Feb 22 (4 days ago)
    Browser United States (OR) (127.34.103.00) Feb 21 (5 days ago)
    Browser United States (OR) (127.34.103.00) Feb 20 (6 days ago)

  • by Anonymous Coward on Tuesday February 26, 2013 @05:58PM (#43018845)

    Gishpuppy offers this service for free [gishpuppy.com] turn in your geek card for not knowing what he is talking about. :)

    There's a Firefox plugin to automatically create addresses. I did this with all my loyalty cards. ???.kroger@gishpuppy.com and ???.walgreens@gishpuppy.com all forward to a special gmail box. If groupon keeps annoying the crap out if me, I can just log-in to gishpuppy and delete that address. All messages will be bounced back.

    Simple as possible, completely free and stunningly effective.

  • by parkinglot777 (2563877) on Tuesday February 26, 2013 @06:02PM (#43018867)
    It doesn't happen to you doesn't mean it doesn't exist. Who knows when Google actually "apply the rule" of dot & no dot to their web mail. My friend recently showed me his emails and some of those do not belong to him. He actually know that the person is living in another city and use the email to register for some clubs or certificates. Nothing illegal but it's been for years and still going on. So my assumption from this is that there are some people who have been left when Google has not applied this "dot" rule. These people still have their email address messed up and have no idea what they can do.
  • Self hosted email... (Score:3, Informative)

    by guevera (2796207) on Wednesday February 27, 2013 @02:19AM (#43022089)
    ...is a bitch to administer. Configuration, authentication, making sure you do all the crap so you don't get flagged as spam. I'll admit that the first time I played with Postfix it took me like two solid days to get everything set up right. You got any recommendations for deployment and admin to save me the headache next time? (Cuz the best part is, it's now been long enough that I've forgotten most of it and it'd probably take me another two days to set up...)

Neckties strangle clear thinking. -- Lin Yutang

Working...