Forum

Account hacked multiple times
 

My account has been hacked a number of times in the last 6 months. Our most recent hack today we received a chat transcript from Ebay and someone basically just logged in as a guest gave them my name and my email address and told them they wanted to change the email and password and Ebay just changed that information. When I called Ebay to get it back they asked me all sorts of security questions and it took me 30 minutes on the phone to convince them it was my account while it took this imposter 5 minutes in the chat to get the information changed and lock me out of my account.

This has happened no less than 4 times in the last 6 months between my Ebay UK and US account. After talking to Ebay they claim there is no way we can secure our account further.

Does anyone else know of anyway to protect their account? I know they dont offer keyfobs and our passwords are crazy long and hard to hack. I wish there was a way to lock the email address and not allow them to change it without a special password or something.

Has this happened to anyone else and did you find a fix?

Re: Account hacked multiple times
 

This kind of behaviour may be linked to the items you are listing! do you list high risk items like tech? mobile phones and their accessories? These kind of things tend to attract scammers, try listing some low risk items for a while and the scammers will leave you alone and go after some of your high risk competitors!

Re: Account hacked multiple times
 

I would change all pc's you use to access eBay as they may have access to it. Maybe keylogger or something. Extra long passwords are impossible to break, well maybe not impossible but it takes lots of time

Re: Account hacked multiple times
 

sıɥʇ ɥʇıʍ spɹoʍssɐd ɹnoʎ ǝʇɐǝɹɔ

Upside Down Writing | Flip text generator

Re: Account hacked multiple times
 

Hackerslist.com launched properly a few months back.

Has made it way easy for disgruntled businessman to reap some revenge for peanuts.

Re: Account hacked multiple times
 

What OS are you running: is it on a PC or laptop? Age of same too.

What security is in place now?

:noidea:

Re: Account hacked multiple times
 

Yeah, we are doing over $1m a month in sales so it is high dollar value items. Unfortunately not really feasible to just de-list everything and wait. I was hoping Ebay would support us and find a way to not change our email and password everytime someone calls ebay and tells them they are me. The only information they have needed is my name and user ID which are readily available obviously.

I am amazed there is no way to get a keyfob or put a block on the account for changing your email or something. Or an add-on for Ebay that would provide extra security. Need to figure something out.

Re: Account hacked multiple times
 

This is not an issue of my computer or password getting hacked. It is Ebay customer service allowing random people to call in and give them my name and email address and then Ebay is allowing them to change the email address on the account and the password right over the phone.

Re: Account hacked multiple times
 

That is insane. They must really be talented.

Re: Account hacked multiple times
 

Run an antivirus on your PC and make sure you dont have any spyware, keyloggers, or trogans on it that may cause this.

Then change your secret questions and answers on your ebay account as this could be what is making them get passed chat

Also make sure your ebay and paypal passwords are different..

Re: Account hacked multiple times
 

I would run several AVs on your PC as viruses can be crypted to avoid getting detected.

Also check in your startup you will see it there, and open your taskmanager and see if you have more than one of the same browser
running,as most keyloggers run through your browser, it can be a number of other programs it can run as this is just an example.

Re: Account hacked multiple times
 

Am i missing something or is the op saying they are accessing his account via ebay chat

Re: Account hacked multiple times
 

Yes, they are just going to Ebay Chat and telling them their email account is shut down and they need to change their email to a new address and a new password and the Ebay rep is just changing it for them. This is how it has happened each time, the passwords are the max character limit with caps, lower case, numbers, and symbols, all jumbled together so it is not an easy password. We have not had any issues with paypal as they will not allow someone to call and change their email without verification.

Re: Account hacked multiple times
 

I have not been able to tell if they have to answer the security questions which are pretty simple when I call. Fathers age range, what company have you worked for in the past, and another one that someone could look up relatively easy since they can pull your name, phone number, email straight from the ebay listings.

Re: Account hacked multiple times
 

Have you called and tried to change it yourself and see what info they ask to do it and than verify the info they require is secure

Re: Account hacked multiple times
 

Here is the chat transcript:

Patricia Y. 16:11:55
Good day! Thank you for contacting eBay Chat Support. My name is Patricia. Can I please get your first and last name?

eBay_Guest 16:12:20
Hello my name is ******* ebay user id *******

eBay_Guest 16:12:51
I can not log in my ebay account and i can not reset my password as my email and phone are no longer working.....can you help me out?

Patricia Y. 16:12:55
Hi there *****! you really have a nice name. How may I help you today?

Patricia Y. 16:13:41
Thank you for letting us know your concern. You don't really have to worry at all because I will do all it takes to sort things out for you. Can you provide me your user id for me to check the status of your account please?

eBay_Guest 16:13:57
(USER NAME)

Patricia Y. 16:14:43
Thank you for the information. May I just ask you do you still have an access on the email address on file?

eBay_Guest 16:15:21
no is not avaible...

After that they basically just gave him the number to call and reference number and told him to call to change the email and password. It was that simple.

Re: Account hacked multiple times
 

Edit and get your personal data out of there

Re: Account hacked multiple times
 

What security questions is what matters so you can find out the leaks.

Re: Account hacked multiple times
 

Woah thats absolutely insane, I've managed TONS of accounts and never ever been hacked and I would never think it'd be that easy. Thats ridiculous, they must atleast ask them for the security answers?

If so you should start making your security answers like:

what is your pets name? DO NOT CHANGE MY EMAIL
what is your favorite toy? HE TRYING TO HACK ME

LOL

Re: Account hacked multiple times
 

If your turnover is more then a million a month you should hire a hacker to find the problem, he will advise you how to protect yourself. It can be one of your employees, it can be a hidden software, it can be one of your partners, anyway you need a security expert.

Re: Account hacked multiple times
 

that's worrying.

I thought they was supposed to ask you your security question to make an changers to your account.

clearly not.

can you ring them and ask them to put a flag next to your account, making sure if anyone rings in about your account they must answer the security questions ?


I also thought to change your email you have to provide password , to change your email I thought you was supposed to have access to your email.

CRAZY .

Re: Account hacked multiple times
 

Also more worrying that the OP has two threads going on the same topic. Really no help to be repeating info on a very serious topic.

:peace:

Re: Account hacked multiple times
 

The security questions they ask are from a generic database they pull up. They are the same questions a bank would ask you for example.

Which of the following addresses have you been associated with.
Which of the following cars have you owned.
Which of the following companies have you been associated with.
What age range is your father in

These are not questions that I set up, Ebay is just pulling them from a database somewhere unfortunately.

Klemantina, I understand what you are saying but the issue does not seem to be related to us. The first two times it happened we beefed up our passwords, firewall, scanned through all our computers, started changing the password daily, etc and they are still getting in and it was not until we got this chat transcript that we figured out how they are doing it.

I was hoping someone knew of a third party extension for Ebay that was security related or some setting with Ebay they would let you do. Everyone we have spoken with there is like "this has never happened before" I would not worry about it. It keeps happening though.

Anyways, thanks all for your suggestions. Ill keep looking

Re: Account hacked multiple times
 

my personal experience - I do not believe a password reset can be happening by phone without access to the email.

I have never been asked the personal questions - just username, email, address, and sometimes phone.

this is for Uk and europe.

I can understand 1 slip-up by a rep, but not alot of times.

I have called a handful of times over the years. I have had to talk my way out of not knowing card for paypal (virtual) and not having access to phone for ebay (lapsed) but if I did not have access to the email then there is no way they would have allowed me to reset a password for ebay or paypal, they send you a link, you can ring as many times as you want, but this is the minimum requirement.

chat used to be more slack, but not anymore, they ask you to call.

lets be cautious that this is not a hacker looking for info.....

Re: Account hacked multiple times
 

Firewall, daily password change and you still getting easily hacked? If i were you I would search an expert to analyse what i'm doing wrong and also try contact people with the same selling volume, preferably from the same niche and ask them if they got the same problem and how they solve it.

Re: Account hacked multiple times
 

Klemantina, thanks for the thoughts. I will try and get with a competitor and see if they have any information but more than likely it might be one of them.

They are basically just changing our listing prices to 50% of the normal price and then putting in an "email me" at this email for a better deal and asking people to WU or Wire them. Just so frustrating because I know they are making maybe $400 each time and causes us a tremendous amount of issues and money. I just wish he would contact me and I could just pay him $400 a month to leave me alone, haha.

Re: Account hacked multiple times
 

I would call in and tell the rep to add a PIN number on your account that only you know and can verify.

The rep MUST ask for that PIN number in order to change anything. Chat OR phone

I am so sorry you're going through this.

Re: Account hacked multiple times
 

There is an option to creat a telephone pin and secret question. Go to my eBay > Account > Persunal (or Bussiness) information > Account information > Create

Can't believe you overlooked that!

Re: Account hacked multiple times
 

OP please don't misunderstand but is it possible that some former employee with access to your email account might have done that?

If you really can exclude that get in touch with OffSec I'm quite sure they can workout a custom solution with you. And if they can't help you they for sure know someone who can.

Re: Account hacked multiple times
 

If you are still having problems let me know I am a security expert and can find the problem for you via team-viewer and remove it if it is a keylogger or RAT.

Re: Account hacked multiple times
 

Thanks Heshl and Ar3s, I will try that in the AM.

After all the hours on the phones with Ebay customer support I have asked them everytime if there is a way to get a keylogger, put a block on changing the email, special pin, or code and all 5-6 people have always said there was nothing additional they can do so I hope this works!

Re: Account hacked multiple times
 

Ok, I was not aware but we did actually have a telephone pin and secret question set up already Ebay is just not asking it. I don't know if this guy is just calling again and again until he gets someone that he can manipulate into changing the information or what is happening.

Does anyone know if Paypal still have keygenerators cards? I see information for them on the paypal website but I cannot figure out for the life of me how to order one. I kind of vaguely remember at one point having one and being able to link it to Ebay. Does anyone do this or have one of these? I dont know if this would help at all since he is just changing the email but figured one more thing could not hurt.

Everytime we call Ebay and complain about it they just say that it could not have happened and no one would do that without the proper information blah blah blah and then we show them the chat history and they just say it will never happen again. Guess what, just got hacked again on Friday and on Sunday a week ago.

I am at a complete loss. I can't imagine it being a keylogger, if so why would they not clear out our paypal accounts or anything like that. The guy is trying to be more stealthy, last time he did not change the password just added to all the listings, "Email me at ___ for a better deal" but left the email and password the same.