So I got hacked and scammed, very poorly.

[jro]

So this morning at about 9:30 I get the text that Amazon sends you when your order is shipped, except I didn't order anything. So I thought, huh, maybe someone else typed in the wrong phone number by mistake (of course that wasn't it).

Figured I should check my Amazon account to see if anything was up. Couldn't get into the account, of course. Tried to get a recovery e-mail, no dice.

Called Amazon. The girl looks at it and goes um, yeah, your account looks like it's been compromised and someone ordered a high-dollar item, and paid via the credit card on the account. She locked the account and told me to refuse the shipment when it arrives, and marked the sale as fraudulent. Said the charge will be refunded when Amazon gets the laptop back (I know it was a laptop but that's all I know since I can't get into the account). And that I should take off work tomorrow to make sure I'm home to refuse the delivery. And she also told me I should check for filters on my gmail.

I check the settings on my gmail, and she was right, there were filters set that I sure as hell didn't set. I took those off, re-set everything, and turned on 2-factor (LTTP, obviously).

Logged into UPS, and sure enough, there's a package tracking coming to my house tomorrow. Signature required. Changed the password there, too.

So... someone must have figured they'd order this, have it delivered to my house while I'm at work, and somehow watch for the UPS truck from who knows where and run up and pretend to be me and sign for it? Seems like they probably were planning to steal it off my porch and didn't realize it would be sig-required, but still.

Am I missing something? It seems very weird that someone would be able to hack several different things, but would still have the package sent to my house, and still have me getting notifications and a pretty sloppy trail.

 

[max 330 mega]

Dude that sucks... I would be fucking PISSED if I had to take off work to deal with that dumb shit.

 

[@M]

Yeah that blows, but glad you caught it in time to thwart their scheme. Maybe get the cops and UPS in on it and set a trap to catch the dumbass?

 

[Dr Shroom]

what's the point of ordering the item using your account and having it sent to your address?

 

[LoneSage]

Be careful at home the next few weeks.

 

[DanAdamKOF]

2FA is a good start, but you should also be using unique randomly generated passwords for each account.

 

[HeavyMachineGoob]

Find the scammer and kill his neighbor, leave a cryptic note on his door the day after the funeral.

 

[ChopstickSamurai]

Dude that sucks... I would be fucking PISSED if I had to take off work to deal with that dumb shit.

Amazon should be able to have UPS put a “intercept” on the package so it gets automatically returned by UPS. I’d call them back and have them do that, unless you really want the day off.

 

[ForeverSublime]

You might want to keep video running outside your home. The person may show up without any idea you're there.

Be safe and keep an eye out in your neighborhood.

If you have another Amazon box, fill it with junk and leave it on your porch.

 

[norton9478]

$10 says it was the ex wife.

 

[NGT]

I thought the weirdest part was they had it delivered to your house, instead of somewhere far away where you couldn't be there.

 

[neo_mao]

$10 says it was the ex wife.

Yep.

Didn’t she order stuff using your cards in the past? A laptop iirc?

 

[Neo Alec]

If you were hacked/compromised, then it was your gmail. They would've been able to change your Amazon password with access to your email. I don't know why they wouldn't change the shipping address though. Maybe it was an accident.

 

[Burning Fight!!]

If you were hacked/compromised, then it was your gmail. They would've been able to change your Amazon password with access to your email. I don't know why they wouldn't change the shipping address though. Maybe it was an accident.

That's why my gmail is a security superfortress. I have a 60 character password that I haven't written ANYWHERE except my brain, and the recovery email for it has another complicated unique password.

If you slip up and use your email password when registering an account that points to that same email, all bets are off, might as well have the password be 'jackpot'. It's only a matter of time until some dumbass site admin slips up and leaves a backdoor open for hackers to steal the user DB... I had previous passwords leaked from dumb sites like Emuparadise to actually "serious" "enterprise" ones like Adobe. If you have an unique password for the "home base" email you can simply reset the password of hacked accounts to something less dumb and regain control, otherwise you'll be lucky to not be locked out completely out of your stuff before noticing someone has your data.

I believe this particular "hack" is from someone that actually has physical access to your computer(s) or had at some point, because no russian scammer would even allow you to log in into your GMail ever again, and imagine how bothersome it would be by someone the next town over to intercept the purchase off your porch. If it was a random scammer you'd have a $1000 bill on buying gift cards or XBOX/PS digital credit.

 

[HDRchampion]

Can we get an update? Is the OP alive?

 

[theMot]

what's the point of ordering the item using your account and having it sent to your address?

It’s Christmas. Spread the joy of giving.

 

[neo_mao]

Can we get an update? Is the OP alive?

He hasn’t logged in since 12/9...same day he made this thread...



Jro - you ok buddy?

 

[Xavier]

It’s Christmas. Spread the joy of giving.

My Amazon account keeps having things appear from my wishlist to my shopping cart. And things that I look at as well. I should look into it further.

 

[bartre]

what's the point of ordering the item using your account and having it sent to your address?

The idea is they have it delivered to your address and steal it off your porch.
The thieves bank on the account holder to write it off as "oh my wife must have ordered that" or something similar and since it's going to the right address it'll just get written off.

 

[NeoSneth]

Sometimes they make legitimate looking purchases first, and then send themselves stuff. I'm guessing they are trying to make it look like you are ordering stuff from their IP legitimately, so it isn't flagged when they change address or ship international.

 

[jro]

$10 says it was the ex wife.

Yep.

Didn’t she order stuff using your cards in the past? A laptop iirc?

Yes, and I thought of her right away. She even bought the same goddamn thing, a laptop.

He hasn’t logged in since 12/9...same day he made this thread...



Jro - you ok buddy?

Lol, I ain't been disappeared yet.

Update: Got up on Tuesday morning and the first thing I see is a text message from UPS saying "your package is ready for pickup" which made me go WTF not good.

So I call UPS right away, and during their always lengthy wait time, I got on MyUPS and looked at the tracking status. It showed that the delivery had been changed to "hold at facility for pickup." So the fucker had called UPS and convinced them he was me, and set the package to be held there.

Dawned on me right away that they never meant for it to come to my house.

On MyUPS, though, I found the option to set the delivery to "return to sender" status, so I did that. It didn't give me that option until the status was changed to hold at facility. I waited for the rep to answer and then asked him to make sure it was listed as RTS, which it was.

I refreshed the status every couple hours to make sure the delivery didn't get changed again, and it didn't.

Early in the afternoon I got an e-mail from "Amazon-csc" in poor English stating that the investigation into my account was concluded and that there had been no suspicious activity and please log back in (fuck you, thank you).

As of right now, tracking shows the package en route back to the shipper. My best guess as to what happened is that one of the usual Nigerian/Indian/whatever scammers overseas did the main part of the scam and probably found some random person who was willing to pick up a package at UPS and leave it somewhere for $50 or whatever, no questions asked. They (original scammer) didn't realize I'd get text updates via MyUPS, which is pretty much what saved me.

 

[Dr Shroom]

My Amazon account keeps having things appear from my wishlist to my shopping cart. And things that I look at as well. I should look into it further.

That happens to me all the time, I still haven't figured out how and why. Nothing ever gets ordered though.

(If you want to buy me shit from my wishlist: pm me)

 

[neo_mao]

Yes, and I thought of her right away. She even bought the same goddamn thing, a laptop.


Lol, I ain't been disappeared yet.

Update: Got up on Tuesday morning and the first thing I see is a text message from UPS saying "your package is ready for pickup" which made me go WTF not good.

So I call UPS right away, and during their always lengthy wait time, I got on MyUPS and looked at the tracking status. It showed that the delivery had been changed to "hold at facility for pickup." So the fucker had called UPS and convinced them he was me, and set the package to be held there.

Dawned on me right away that they never meant for it to come to my house.

On MyUPS, though, I found the option to set the delivery to "return to sender" status, so I did that. It didn't give me that option until the status was changed to hold at facility. I waited for the rep to answer and then asked him to make sure it was listed as RTS, which it was.

I refreshed the status every couple hours to make sure the delivery didn't get changed again, and it didn't.

Early in the afternoon I got an e-mail from "Amazon-csc" in poor English stating that the investigation into my account was concluded and that there had been no suspicious activity and please log back in (fuck you, thank you).

As of right now, tracking shows the package en route back to the shipper. My best guess as to what happened is that one of the usual Nigerian/Indian/whatever scammers overseas did the main part of the scam and probably found some random person who was willing to pick up a package at UPS and leave it somewhere for $50 or whatever, no questions asked. They (original scammer) didn't realize I'd get text updates via MyUPS, which is pretty much what saved me.

The way I see it is that there is still a possibility that was all orchestrated by your ex-wife so just to be on the safe side I think you should post nude pictures of her again.

 

[lithy]

Don't worry jro, I got this thread ready in case you go MIA.

http://www.neo-geo.com/forums/showthread.php?194071-Members-you-think-might-be-dead

 

[jro]

Don't worry jro, I got this thread ready in case you go MIA.

http://www.neo-geo.com/forums/showthread.php?194071-Members-you-think-might-be-dead

I can go right next to galfordo and feelgood on the milk carton.