EMAILED SPOTIFY RECEIPT HACKED VERIFICATION
EMAILED SPOTIFY RECEIPT HACKED PASSWORD

Do a search on HaveIBeenPwned to see if any of the websites where you have used that email were compromised.

EMAILED SPOTIFY RECEIPT HACKED PASSWORD

You should explore the possibility that your password may have leaked. If it was an OTP failure, you would have received an OTP when that login attempt was made (unless your OTP delivery mechanism is not email or SMS based). From the details of warning you have provided, it looks like it is from fraud detection rather than an OTP failure. This should be of concern to you because an attacker was able to obtain the valid password for your Gmail account. It looks like your risks and threats are limited and you have responded appropriately. But only so far as the need to strengthen your password (longer password, 2FA, more monitoring, etc.). After a while, they should stop using your email and move on to another of the thousands available. The risk here is that your email is now well-known to malicious actors who know about it because they want to exploit it. Why seemingly random services? To bypass bans on their main accounts, to launch forum bots, spam bots, reputation or like bots, or a whole host of automated unkindnesses. Now people are using your email from that database as a known 'hacked account' to sign up for services, not knowing that the bot's activity was discovered and you changed the password. It might not even know that Google blocked it from going further. With your weak password, one of these bots could have discovered the correct credential, stopped, registered it in a database, then moved on. (I do presentations where I show how the hackers work command by command once they gain access. In my experience, I see the successful automated brute force which suddenly stops, then days later, I get people logging in from around the world and running malicious scripts by hand. It is then exposed or sold off to those wanting to use it. Its job is only to register the correct credentials. The pattern is that the bot tries to log in, then once login succeeds, it simply stops. I run my own honeypots and I get these all the time. There are automated scripts out there that try to bruteforce all kinds of accounts for the purposes of selling access to those accounts. They might get frustrated that they have lost access to what they thought was theirs.

The risk in this scenario is very low since everyone involved has no ill intent and things were done by mistake. While some of those might be hackers trying to get in, the volume, and the fact that they come in bursts, suggests that these are people trying to get into what they think is their own accounts. They have kept on using the email to sign up for things thinking that it is truly theirs.Īlong with the dozens of wrong emails I get, I also get quite a lot of 'password reset' attempts. The logged-in party tried to log into what s/he thought was their account to get access to the email and, using your weak password (as you have admitted), got lucky enough to log in. However, there are a couple of scenarios that I see if there is some kind of correlation between the two events: Scenario 1: Innocent Intent So, this set of events might not relate to the person who logged in. I get a dozen of these types of 'mistakes' a week from around the world due to my fairly generic email account. The use of your email to sign up for services might be a coincidence and not being done by the party who logged into your account. I changed it to a password that's much stronger now.Īlso, if the attacker didn't gain control of the account, why use it to enroll in all these services? The account in question is not my main account, and while the password on it was admittedly weak, it was also unique (I never used it on anything else). Someone out there is actively using my GMail address to enroll for these services.

EMAILED SPOTIFY RECEIPT HACKED VERIFICATION

However, in the 2 weeks since then, I have received several email verification requests from various online services that I never signed up for - Spotify, OKCupid, a Nissan dealership in Pennsylvania (that one's interesting), and a few others I've never heard of before. Or maybe Google's fraud detection is actually decent and it knows I've never been to the Philippines? Either way, I immediately changed the password and (as far as I know) the attacker didn't gain control of the account. I gather this means that an attacker entered the correct user name and password for my account, but was likely blocked because they couldn't pass the MFA challenge. I signed into that account and looked at the activity (not by clicking the link in the message, of course) and indeed there was a sign in attempt blocked from the Philippines. Google blocked them, but you should check what happened.

Someone just used your password to try to sign into your account. Just before Christmas I received the following message in one of my GMail accounts:

Emailed spotify receipt hacked