Account Takeover - Amazon and Gmail

customerservicepah

I wanted to share with you recent experiences of dealing with Amazon and Google.

Unfortuantley we have been victimes of fraud using my BarclayCard account on Amazon. Someone obtained my Amazon user name and password (we think from our iPad - another story) and used this to purchase expensive Smartphones. Thankfully BarclayCard spotted these as potentially suspect transactions and notified me aas well as put a hold on the payments. We tried to access our Amazon account and discovered we were unable too. We contacted the "customer service" who failed to grasp the problem and its severity. Although they did disclose that a new email address had been added to the account (which they then disclosed to us!). We were eventually assured that the account would be lockjed and no further activity could take place until the Account Issues team had investigated and contacted us. We were then send a badly worded email stating that as no suspect activity had taken place then the account was free for us to use! This was particularly concerning as we then learned that further attempts to purchase items on our account had taken place - again thankfully BarclayCard were on the ball and stopped the transactions. After calling Amazon again serveral times, they advised they would email us instructions on how we could reclaim our account and change username and password. As we sat reading the emails, further emails appeared advising that we had changed our secondary email address and password, we were then lost access to the email account - the lowlife hackler had struck again. So now we tried to reclaim email account with Google. After trying all online tools, we were eventually given the option to speak to someone, they went through a process but as we could not provide the date when we opened the email account, they would not help us and therefore the fraudster was left with access to the account. We have tried and tried to get through to someone to help but to no avail. So cards to all bank accounts have been cancelled, all passwords to any account we have have been changed (using our Windows PC (fully protected with appropriate software)) and iPad and iPhone reset (now sitting idle whilst we work out what to do - as we were under the impression that Apple iOS were reletively safe from this kind of thing). So in summary:

1) Amazon customer service - really? No help and no concern for us of them - my early warning could have prevented further fraud yet they ignored it.

2) Google - how is it right that I have to jump through hoops (it now appears we have exhausted all avenues) to reclaim account meanwhile the fraudster could be doing who knows what in my name

3) Apple iOS - are they really as secure as they claim?

Apologies for the rant however so frustrated I needed to get it all out.

Any ideas, comments, experiences concerning any aspect of the above would really be appreciated.

societys_child

3) Apple iOS - are they really as secure as they claim?

No, of course not, it's a myth but they don't want to tell you that.

WTFH

Why do you think the problem came from your ipad?

I'm not saying it didn't, I'm asking why you think it started there.

cookie365

What would you expect Google and Amazon to do when someone rings up asking for account information, without being able to provide any security information about the accounts?

If you allow someone to steal your account logins, don't allow them to steal the related email account logins too.

gb12345

gmail has a wonderful think called 2-step verification. It's a pity you didn't think to make use of it then you wouldn't have lost the access to your email account.

SuperHan

Now here's a hacking story...

http://www.emptyage.com/post/28679875595/yes-i-was-hacked-hard

You really need to keep passwords sufficiently secure and accounts separate enough that it's difficult to use the details from one.

On the Apple front, they're relatively secure, but still somewhat vulnerable when for example you use public wifi. Why do you think this is the source of the issue?

Nilrem

As mentioned Apple IOS isn't anything like as secure as some people think*, for a long time Apple OS's on their PC's didn't have as many virus's etc as Windows did, simply because they weren't as common (so not worth writing malware for them).
These days everyone and their trendy "with it" aunt seems to have an IOS device and is using them for shopping/email etc, so the bad guys are spending a lot more time looking for weaknesses for them - and unfortunately Apple don't seem to be quite as fast on fixing them as they could be at times (MS is or was bad for a long time, but after years of bad press have really upped their game in terms of at least trying to deal with security issues).
However a secure OS doesn't help at all if the device is unlocked and lost (and in the case of the Idevices there are various ways around the locks because of the aforementioned security issues**).

Unless you lock your portable devices every single time you use them, never let their browsers remember your password, and never tick the "keep me logged in" box (even better use "private browsing"), as you're far more likely to lose something like an ipad or phone than your PC, and if they've got your password etc on them you're screwed.

Also always use a good password for any email accounts, especially those you use for things like online shopping - I've lost track of the number of times I've seen someone confused as to how their online shopping accounts have been compromised, and it turns out they used a really easy to guess password on their hotmail/gmail account (both of which by default keep copies of your incoming emails making it really easy for someone to see what stores you shop at, and then do a password reset).


*There are still some people that think there is no malware/virus's etc for Mac's, something I don't think was ever true (any OS that is reasonably popular will have malware created for it, either for fun, or profit).

**IIRC the issues have been as simple as doing something that a locked device would let you do, then doing something it should have required unlocking to do (apparently for a while the IOS got confused at times with some actions that should have required the device to have been unlocked by the user, if they followed an action that didn't).

WTFH

Nilrem wrote: »

**IIRC the issues have been as simple as doing something that a locked device would let you do, then doing something it should have required unlocking to do (apparently for a while the IOS got confused at times with some actions that should have required the device to have been unlocked by the user, if they followed an action that didn't).

I never thought of that - so I just played around with the various things you can get to on an iPhone (iOS7) when locked - each time I try to get from one of them into something else it throws me back to the lock screen, so hopefully that issue is no longer there.

Jakg

The iOS lock screen bugs have, at most, allowed you to view contacts, make calls or view photos - and these exploits were only open for a few days each, not at the same time, and very tricky to do And still wouldn't gain full access to the device And obviously required the attacker to be there, with you. The risk is much lower than say, Android.

I'd love to know why the OP thinks their iPad was the source of the problem...

WTFH

Looks like another "fire and forget" poster. Fires off a thread, then forgets to reply.

williham

Jakg wrote: »

The iOS lock screen bugs have, at most, allowed you to view contacts, make calls or view photos - and these exploits were only open for a few days each, not at the same time, and very tricky to do And still wouldn't gain full access to the device And obviously required the attacker to be there, with you. The risk is much lower than say, Android.

I'd love to know why the OP thinks their iPad was the source of the problem...

Agreed. Much more likely that the 'safe' windows PC has malware.