Blackmail Email which contained a password

Blackbeard_of_Perranporth

Oh, the special pixel makes a return! I'll get some popcorn and wait for my version!

AndyPix

^^^ ?? come again ??

that

forgotmyname wrote: »

How accurate is that website? I have a few email addresses that i use for spam and 2 are showing, one is myspace which i know about.

A bit of background. the information for compromised accounts were put online and people grabbed them. These sites could have been from sony, yahoo, talktalk, adobe, etc. One or more researches also grabbed the lists, removed the passwords but made the account names publicley available - if you know what name to type - like https://haveibeenpwned.com/ and there were at least 2 other sites like this last time i looked

After searching for a few lists, I found that the sites that hosted these lists like Reddit pulled the posting from their forums.

As we have heard hundreds of times, 'Dont reuse old passwords" and "Dont use the same password for multiple sites'

Blackbeard_of_Perranporth

AndyPix wrote: »

^^^ ?? come again ??

The special pixel that is inserted into the email so if you don't coff up with your credit card ££££ they can use this to ...

You now have one day to make the payment. (I have a special pixel within this email message, and now I know that you have read this e mail).

https://www.actionfraud.police.uk/news/alert-cyber-criminals-send-victims-their-own-passwords-in-new-sextortion-scam-jul18

Uxb

robinwales wrote: »

You also need to use 2-step verification on Google and Amazon, and any other site that has it. If you have that, anyone who gets your current password also needs your phone.

All of which is fine until your phone is lost/stolen/bust and the number is blocked.
Then you are up the creek without a paddle as you cannot log on to change the phone details without having access to the lost phone in the first place to gain access.
All of which means you will need to phone customer services at the likes of Paypal (good luck!) to find alternative ways of proving your ID (I wish you even more luck) to get them to switch off the 2 factor to allow you back into your account.

I'm sure you will get it all sorted - eventually - well maybe...

Rule 1 do not use two factor unless you have and the organisation provides an alternative emergency way into the account if the second factor is comprimised or lost. These might be emergency access codes or maybe a second mobile or a landline number as an alternative factor.

S0litaire

Got the same email (Also got the previous version with no password)

It went directly to spam
Noticed the old password, Had a chuckle and deleted it...

S0litaire

Uxb wrote: »

All of which is fine until your phone is lost/stolen/bust and the number is blocked.
Then you are up the creek without a paddle as you cannot log on to change the phone details without having access to the lost phone in the first place to gain access.
All of which means you will need to phone customer services at the likes of Paypal (good luck!) to find alternative ways of proving your ID (I wish you even more luck) to get them to switch off the 2 factor to allow you back into your account.

I'm sure you will get it all sorted - eventually - well maybe...

Rule 1 do not use two factor unless you have and the organisation provides an alternative emergency way into the account if the second factor is comprimised or lost. These might be emergency access codes or maybe a second mobile or a landline number as an alternative factor.

Don't worry...

Google is bringing out it's own 2FA Fob/USB key in a few months.

https://9to5google.com/guides/google-titan-security-key/


:rotfl::D

[Deleted User]

simpywimpy wrote: »

Im usually pretty savvy with scams and hoax emails etc but because the password was in the subject line it made me feel sick.

It was all lower case so definitely an old one

Thank you for putting my mind at rest.

What have you been doing/watching that got you all worried???

18cc

Google have four ways to verify two Factor authentication

one is as you say they send a text to your mobile which is not a lot of use if you have lost your mobile

however there is the Google Authenticator which you can put on a separate device e.g. iPad that you have at home

you also have an alternative email address and finally you have a list of 10 verification codes you can type in if all else fails

Finchlark10

So today I received an email from my gmail account with my (old) password, so basically from me, as proof that they had hacked my account. Requiring Bitcoin payment. Saying they could tell if I changed password, etc saying they have installed rat software.