Amazon account hacked?

[ripler]

So I got an email Tuesday evening from Amazon thanking me for leaving a review for a product that I never bought or left feed back for. Then at 2:20 AM Wednesday I got another email from Amazon saying that I successfully changed my password, but I didn't. I didn't find out until Wednesday when I checked my personal email from work, I immediately logged on and changed my password and to see if anything was purchased. Nothing was purchased, the only thing that was done was the review for the item. I contacted Amazon and suspended my account while they looked into what happened. I got an email yesterday saying that my CC info can not be seen on their website and can't be accessed. My account is still disabled until I log back in and change it and they cancelled any pending orders. They say that they don't know how this person got my sign in information because it happened outside of their website. I'm confident that I didn't get phished since I will not click on any links from email and I use security on my home computer. I wonder if they were able to get this info from the Amazon app on my cell phone?

 

[McMark]

I really hate hearing things like this. Amazon mojo out to ya!

 

[Bruce]

Do you use the same password on any other websites?

I use different passwords for trusted and untrusted sites even using different passwords for some trusted sites.

Our forum stores passwords in an encrypted form. It never stores the actual password but stores a hash to verify that it is correct.

Having access to that hash I could try random combinations until it was guessed. Doing so programmatically is a slow but possible process. Especially if you have the entire list of account passwords to test each random string against.

A nefarious website operator could log passwords in plain text. Taking that further they might even log incorrect passwords. Doing so might result in a collection of passwords used by the users.

Passwords systems are easily corrupted. My best advice is to use unique passwords on the sites you really want to protect and a fairly generic password for the rest. Of course two factor authentication is even better.

 

[greg]

Did you check if they archived any purchases. could be a quick way to hide it.

 

[GoVols01]

Order a bunch of boat parts and have them shipped to your house. Tell your wife it must have been the hacker that did it.

 

[Beachbummer]

Did they order anything? Where the emails really from Amazon? The emails could be phishing attempts to get you to click on them. Are you sure they actually logged in to your account?

 

[Julian]

My Amazon account was hacked last year, and Amazon caught it and emailed us minutes after it happened. Changed the PW and that was it.

Bruce is correct, hackers have a file that contains every password for up to 14 digits. If your username is the same as you use elsewhere then all they need to do is brute force it. Most sites now will shut down your account after too many failed attempts....fairly sure Amazon has done that.

Public wifi is another way for them to intercept your Username and PW.

The of course there is good old spying....25x video cameras are dime a dozen.

I use MFA (multi factor Authentication) where ever possible.

I did have a blast a month ago with a "Microsoft" employee who called me to tell me my PC was infected. Even got to the point of trying to encourage him to quit his job and get a real job that isn't preying on old people (he was asking for my dad who is 85 - another scam he fell for was a young kid called him and said "Grandpa I've been arrested", his hearing is so bad he replied "Is this Bradley" and of course the kid says yes. He tried to get my dad to wire him money. Thankfully Dad didn't and called my brother. They are tricky little bastards. And there are thousands of them, all they do all day is try and steal our shit. I say we declare Cyber crimes as war crimes and start taking these aholes out!!!!

 

[H2OBoy]

I got a very similar set of emails recently, but instead of Amazon it was Lyft, and I have no Lyft account. One email was a receipt for a ride, another showing a review, then another asking me to confirm my email. The receipt had the last 4 digits of a CC number which I compared to all of mine. It did not match. I assume this was something designed to get you to click on a link within the email. I just deleted them and have not seen anything since.

 

[vanmurray]

So I got an email Tuesday evening from Amazon thanking me for leaving a review for a product that I never bought or left feed back for. Then at 2:20 AM Wednesday I got another email from Amazon saying that I successfully changed my password, but I didn't. I didn't find out until Wednesday when I checked my personal email from work, I immediately logged on and changed my password and to see if anything was purchased. Nothing was purchased, the only thing that was done was the review for the item. I contacted Amazon and suspended my account while they looked into what happened. I got an email yesterday saying that my CC info can not be seen on their website and can't be accessed. My account is still disabled until I log back in and change it and they cancelled any pending orders. They say that they don't know how this person got my sign in information because it happened outside of their website. I'm confident that I didn't get phished since I will not click on any links from email and I use security on my home computer. I wonder if they were able to get this info from the Amazon app on my cell phone?

1) Check to see if you are out there with passwords you reuse.
https://haveibeenpwned.com
2) Setup 2FA (on everything — but especially Amazon)
https://www.theverge.com/2015/11/18/9753888/amazon-two-factor-authentication-2fa

 

[Gym]

So I got an email Tuesday evening from Amazon thanking me for leaving a review for a product that I never bought or left feed back for. Then at 2:20 AM Wednesday I got another email from Amazon saying that I successfully changed my password, but I didn't. I didn't find out until Wednesday when I checked my personal email from work, I immediately logged on and changed my password and to see if anything was purchased. Nothing was purchased, the only thing that was done was the review for the item. I contacted Amazon and suspended my account while they looked into what happened. I got an email yesterday saying that my CC info can not be seen on their website and can't be accessed. My account is still disabled until I log back in and change it and they cancelled any pending orders. They say that they don't know how this person got my sign in information because it happened outside of their website. I'm confident that I didn't get phished since I will not click on any links from email and I use security on my home computer. I wonder if they were able to get this info from the Amazon app on my cell phone?

I'm curious...If the hacker changed your password how did you log in to see if anything else was ordered?

 

[the MfM]

Didn’t have my passwords stolen that I know of but someone got ahold of my credit card info. Ordered something for $450 I noticed the charge a couple days later and called the credit card company and reported the fraud.

Couple days ago a 150” hdtv projector showed up on my doorstep. With an invoice for $450. Called my credit card company and they said don’t do anything. If someone calls me asking for the projector then report it to the local police.

Apparently this is one of the latest scams.

 

[Peelz]

The original email could have been fake for phishing. it GETS you to divulge your password through the link if you click it.. Thus Making you an accessory to your own hacking.


I got a few really convincing ones that SAY they're from Amazon. Also got One from "apple support" telling me about a possible hack and $100 purchase in NY. with a "login" button My wife forwarded it in a panic. If you Hover cursor over contact info...random Russian.

Hope it works out!

 

[ripler]

I'm curious...If the hacker changed your password how did you log in to see if anything else was ordered?

When you log onto Amazon with your username you can click forgot my password and they will email you a temporary PIN and you use that to log on, then you can change your password.

 

[Adrian @ JB Solutions]

Didn’t have my passwords stolen that I know of but someone got ahold of my credit card info. Ordered something for $450 I noticed the charge a couple days later and called the credit card company and reported the fraud.

Couple days ago a 150” hdtv projector showed up on my doorstep. With an invoice for $450. Called my credit card company and they said don’t do anything. If someone calls me asking for the projector then report it to the local police.

Apparently this is one of the latest scams.

Sooo... did you end up with a free projector?

 

[ripler]

The original email could have been fake for phishing. it GETS you to divulge your password through the link if you click it.. Thus Making you an accessory to your own hacking.


I got a few really convincing ones that SAY they're from Amazon. Also got One from "apple support" telling me about a possible hack and $100 purchase in NY. with a "login" button My wife forwarded it in a panic. If you Hover cursor over contact info...random Russian.

Hope it works out!

I don't click on any links in emails, if need be I will logon to the company's website directly and go from there.
I work for a huge company that has a ridiculous amount of security and we are constantly being sent fake emails from our company to test if we are being careful.

I'm thinking it may be payback from the guys that I harass on the phone when they robo call me because my computer has a virus.

 

[the MfM]

Sooo... did you end up with a free projector?

I think I may have.

 

[Peelz]

I don't click on any links in emails, if need be I will logon to the company's website directly and go from there.
I work for a huge company that has a ridiculous amount of security and we are constantly being sent fake emails from our company to test if we are being careful.

I'm thinking it may be payback from the guys that I harass on the phone when they robo call me because my computer has a virus.

surprising how many people fall for it. we get them regularly in our work network.... followed by a reminder to NOT click and enter passwords...followed by another round saying oh now we all need to change our passwords LOL

folks can be gullible. wife told me in some of their stores, scam where someone calls employee trying to "test" the gift card system, ultimately getting a gift card # out of them and activating it to "test" it. by the time theyve figured it out, money is spent.

 

[Betik]

I think I may have.

If you disputed to the charge with CC, please keep in mind that the Issuer ( financial institution that issued your credit card) owns the equipment. Most likely they will not bother to claim it.

 

[the MfM]

If you disputed to the charge with CC, please keep in mind that the Issuer ( financial institution that issued your credit card) owns the equipment. Most likely they will not bother to claim it.

That’s what the rep said when I called and told them it showed up. I’m waiting for them to complete their fraud investigation to find out what to do with it.

I’ve gotten a few weird text messages wanting me to click a link for “order updates” from some random companies I don’t recognize so far I’ve just ignored them.

 

[biglar155]

For password management, I'd recommend "Keepass" (https://keepass.info/). (I have no other affiliation with keepass than the fact that I have been a user for a few years now.)

It's a great (free) little utility that you can use to safely store and organize your passwords. (Dear Lord PLEASE don't let your web browser store them!)

Keepass can generate totally random passwords for you. So the next time you need to create an account, you just create a new entry in Keepass and it will make the password for you.

I've grown to trust Keepass to the point that I generate random answers to security questions and store them in the "notes" section of the entry.

Keepass is also a great place for your on line account web sites.

The whole smash is encrypted with 256 bit encryption (the whole entry, not just the password) that uses your Keepass password as the key. (You can even use a file on your computer as part of the key, just don't modify the file or you'll be locked out forever!)

Between my personal accounts, work accounts, and devices that need passwords I have well over 100 passwords. I only actually KNOW a handful of them (like the one to log in to my computer and the one for keepass itself). Everything else is in Keepass.

A friend of mine kept encouraging me to try it. I finally relented about the time Target got breached and I decided to change all of my on-line passwords. I went though them all and put them in Keepass with random passwords.

Best move I ever made. I've been using it for several years now and I couldn't be happier with it.

I won't lie, it DOES take a little extra management and you need get a little creative sometimes to overcome the pain of manually typing in 20 random characters, but to me it's well worth a little extra work. (MiniKeepass is available for your phone.)

You have to decide to commit to using it. Once you get over the initial pains you'll never look back.

I've come to realize that cyber-security is like concealed carry: It's COMFORTING but not always COMFORTABLE.