Warning: Amazon hacked account

vigman

Hi

I am pretty good with security and long obscure passwords, but someone has hacked my Amazon account today and luckily placed too many orders.

They had changed my delivery address to one in Holland.

My password is reset and I am assured I will not be charged for these purchases but if it has happened to me it might happen to you as well.

Vigman

Nile

vigman wrote: »

Hi

I am pretty good with security and long obscure passwords, but someone has hacked my Amazon account today and luckily placed too many orders.

They had changed my delivery address to one in Holland.

My password is reset and I am assured I will not be charged for these purchases but if it has happened to me it might happen to you as well.

Vigman

On a similar note, Barclaycard fraud have contacted me (I'm an Amazon customer) today. They wanted to block my credit card as a precaution.;)

Nilrem

Op, if your Amazon account has been compromised and it had good security one of the first things I would do is check the security of your linked email account.

If someone gets into your email account which is often easier than an online store, they can check what emails you're receiving and get access to any online accounts that use that address by doing a "password reset".
Which is far easier than trying to actually hack the online store account, especially if they already have any information about you taken from say another site (for example if you use a forum and it's hacked they might get your town of birth or date of birth and email address from that, which gives them a start on accessing your email address).

Nile wrote: »

On a similar note, Barclaycard fraud have contacted me (I'm an Amazon customer) today. They wanted to block my credit card as a precaution.;)

they did me as well the other day.

BUT it was a card I had never used on Amazon* (I have two, the one that has never been linked to Amazon was compromised).

There are probably more Barclaycard customers who use Amazon than Barclard customers who don't



*Besides anything else it was a new card to replace one that had expired a few months earlier.

Browntoa

looks like kindle users


https://www.hackread.com/amazon-suffers-security-breach/


http://www.theregister.co.uk/2016/07/11/amazon_denies_hack_claim/


although they deny it

forgotmyname

My passwords so easy im surprised it has not bee hacked. its a 5 letter word...

A 386 computer could crack it in under 5 minutes.

But where are they going to get my details from to attempt the hack?

ARandomMiser

forgotmyname wrote: »

My passwords so easy im surprised it has not bee hacked. its a 5 letter word...

A 386 computer could crack it in under 5 minutes.

But where are they going to get my details from to attempt the hack?

A 5 letter word can be cracked in a fraction of a second.
Hackers rely on people being nonchalant and even sometimes being arrogant in thinking they can't be hacked, but all it takes is for something related to you to turn up in some mailing list or intercepted during normal internet surfing or phishing activity for them to give your account a go at hacking. If they get in do not assume that is the account they are after, they will then try those and similar details against banks and other sites to see if they get 'lucky' - that is when the damage is done.

Strengthen up your passwords, use numbers and symbols - but preferably not by replacing the obvious characters (e.g. '0' and 0, 'i' and 1 'r' and 2, 'e' and 3 etc.) since those are well known and just as easily hacked ... and for goodness sake do not use the same password (or variations of the same password) for all your bank accounts - once one bank is hacked, a hacker will try the same/similar details on every other bank.

Sicard

Apparently, according to two hacking experts on this forum, Hotmail cannot be hacked otherwise it would be headline news

soolin

Browntoa wrote: »

looks like kindle users


https://www.hackread.com/amazon-suffers-security-breach/


http://www.theregister.co.uk/2016/07/11/amazon_denies_hack_claim/


although they deny it

I shall keep an eye on mine then.

Nilrem

ARandomMiser wrote: »

A 5 letter word can be cracked in a fraction of a second.
Hackers rely on people being nonchalant and even sometimes being arrogant in thinking they can't be hacked, but all it takes is for something related to you to turn up in some mailing list or intercepted during normal internet surfing or phishing activity for them to give your account a go at hacking. If they get in do not assume that is the account they are after, they will then try those and similar details against banks and other sites to see if they get 'lucky' - that is when the damage is done.

Strengthen up your passwords, use numbers and symbols - but preferably not by replacing the obvious characters (e.g. '0' and 0, 'i' and 1 'r' and 2, 'e' and 3 etc.) since those are well known and just as easily hacked ... and for goodness sake do not use the same password (or variations of the same password) for all your bank accounts - once one bank is hacked, a hacker will try the same/similar details on every other bank.

One tip I've seen is that apparently rather than random characters it can be better to use something like using random words as it's long enough and hard enough to make it difficult to crack, but also easier for you as a human to remember (so you're not likely to write it down).

For example hairYWormwins20bottles or flyingapesmake13luckylandings unfortunately a lot of sites don't allow passwords long enough to do such things.
So other ways of doing it might be the first letter or two of each word in a song, or the first letter from the start (or end) of every line of a poem.

maninthestreet

MyHovercraft1sfu110f33ls

vigman

More serious. I changed my password to a random unhackable one yesterday, but today the same person has got back into my account and made another order and re-added their delivery address.

They seem to be using some kind of Amazon Gift Card scam where the payment is from a gift card balance I don't have????

Amazon looking into it again but this is very worrying.

This is on a non-public computer with industrial strength protection (I was an IT Manager)

I have only just read the other replies. My linked email account is a gmail one and the only one I use now.

Vigman