Live account breached - MS insist I've been phished
Discussion
Throwing this up on the off chance that anyone else has experienced it - I'm getting nowhere with Live support and don't know where else to turn to sort things out. Consider it more of a vent/rant!
Some scumbag has managed to spend £51 on MS Points using my Live account, and tried to add a second email address in order to recover/steal the account from me. My phone alerted me to the emails so within seconds I was able to cancel the request, change my password and stop them taking over my account.
I've spoken to two different guys at Live support - the first told me that a number of linked EA accounts have been compromised and that's how they've accessed my details - but before he could pass it on to the fraud team and get me a refund, he cut me off.
The second insists that I must have clicked a dodgy link in an email or given another player on Live my account details, and so refused to pass it on for an immediate review, instead flagging it for a 25 day suspension and wait for investigation before a refund even becomes possible.
The thing is - I use a single GMail account only for Xbox Live, Steam and EA accounts and going through every single email in that account, there isn't a single one that I'd have any reason to click a link in - not that any of them are dodgy in the first place. As for giving my own account details away, I've not been on Live since May and my player history shows this. Hell the Xbox has been unplugged for the past month!
Scouring the web and even the Xbox forums, there are plenty of people in the same boat as me and the standard response seems to be You're an idiot, you should have been more careful with your details..
The only people I've given my details are MS, through my sodding Xbox!
And breathe...
Some scumbag has managed to spend £51 on MS Points using my Live account, and tried to add a second email address in order to recover/steal the account from me. My phone alerted me to the emails so within seconds I was able to cancel the request, change my password and stop them taking over my account.
I've spoken to two different guys at Live support - the first told me that a number of linked EA accounts have been compromised and that's how they've accessed my details - but before he could pass it on to the fraud team and get me a refund, he cut me off.
The second insists that I must have clicked a dodgy link in an email or given another player on Live my account details, and so refused to pass it on for an immediate review, instead flagging it for a 25 day suspension and wait for investigation before a refund even becomes possible.
The thing is - I use a single GMail account only for Xbox Live, Steam and EA accounts and going through every single email in that account, there isn't a single one that I'd have any reason to click a link in - not that any of them are dodgy in the first place. As for giving my own account details away, I've not been on Live since May and my player history shows this. Hell the Xbox has been unplugged for the past month!
Scouring the web and even the Xbox forums, there are plenty of people in the same boat as me and the standard response seems to be You're an idiot, you should have been more careful with your details..
The only people I've given my details are MS, through my sodding Xbox!And breathe...
Brilliant - apparently I have at some point created an EA Account with a different username, but using the same password as my Live account. Probably in Battlefield Heroes or Madden. Then I've linked the EA Account to the Live account to get Veteran status for owning Battlefield 1943, thus revealing my Live gamertag to anyone who can see my EA account.
A few months back Lulzsec got hold of all the login details for Battlefield Heroes and stuck them online. Someone else appears to have put 2+2 together with that old EA password and my Live gamertag, et voila. Access to the whole lot.
Now I do feel slightly stupid for using the same password, but it would have been nice to have thought a 12 character mix of upper/lower case numbers, characters and symbols was reasonably safe. Except of course if EA leave it in plain sight.
There's a lesson in there - having a separate passwords for groups of things like 'games', 'forums', banking etc is useless if one in the group gets compromised. Need a better memory and unique passwords for everything.
A few months back Lulzsec got hold of all the login details for Battlefield Heroes and stuck them online. Someone else appears to have put 2+2 together with that old EA password and my Live gamertag, et voila. Access to the whole lot.
Now I do feel slightly stupid for using the same password, but it would have been nice to have thought a 12 character mix of upper/lower case numbers, characters and symbols was reasonably safe. Except of course if EA leave it in plain sight.
There's a lesson in there - having a separate passwords for groups of things like 'games', 'forums', banking etc is useless if one in the group gets compromised. Need a better memory and unique passwords for everything.
Call then again with your reference number and speak to someone else. My account is currently locked down for the same reason, access by another and email change, then points purchased and transfered. All happened while I was at work. f
king s
Microsoft could not be more helpful in sorting it (at the moment). Confirmed who I was with loads of questions, went through my recent gaming history and confirmed with a very quick check that my account had been 'breached' (their word). Once this was confirmed to me they took alternate details regarding email and phone number and then provided a reference number and explained in detail what happens next.
I called back a few days later when the official anouncment was made about people falling victim to scams as like you I have not received any emails asking me to click links nor have I tried to secure 'free ms points' in anyway. Obviously the 'official' statement was piss boiling for me.
I got through almost right away and was assured that the official statement did not apply to my account as the guy on the phone could already see my account was at 'Tier3' level of investigation... which means it's now in the hands of xboxlive US securtiy department who are in the process of tracking consoles that benefited from the points that were purchased. I was told that accounts only go to Teir3 once they have accertained the account is victim of a breach and not a scam. My account went to Teir3 the day I called to report it first time. Once this Teir3 investigation is done and those consoles who benefited are deactivated I will apparently receive further information on how to recover my gamer tag and have my account restored to it's 'pre-hacked state' (again, their wording).
The only thing keeping my calm is that apparently my gamer tag and all the purchases assigned to it are safe and locked down and will be restored to the state before the breach took place (including credit on live and maybe even some points... that's the bit to be negotiated)
king sMicrosoft could not be more helpful in sorting it (at the moment). Confirmed who I was with loads of questions, went through my recent gaming history and confirmed with a very quick check that my account had been 'breached' (their word). Once this was confirmed to me they took alternate details regarding email and phone number and then provided a reference number and explained in detail what happens next.
I called back a few days later when the official anouncment was made about people falling victim to scams as like you I have not received any emails asking me to click links nor have I tried to secure 'free ms points' in anyway. Obviously the 'official' statement was piss boiling for me.
I got through almost right away and was assured that the official statement did not apply to my account as the guy on the phone could already see my account was at 'Tier3' level of investigation... which means it's now in the hands of xboxlive US securtiy department who are in the process of tracking consoles that benefited from the points that were purchased. I was told that accounts only go to Teir3 once they have accertained the account is victim of a breach and not a scam. My account went to Teir3 the day I called to report it first time. Once this Teir3 investigation is done and those consoles who benefited are deactivated I will apparently receive further information on how to recover my gamer tag and have my account restored to it's 'pre-hacked state' (again, their wording).
The only thing keeping my calm is that apparently my gamer tag and all the purchases assigned to it are safe and locked down and will be restored to the state before the breach took place (including credit on live and maybe even some points... that's the bit to be negotiated)
Thanks for that Civpilot, 'glad' (not sure that's the right word but you know what I mean) I'm not the only one who couldn't work out what the hell was going on. It was indeed piss boiling to be told that I must have done something so elementary as to click a link in a random email without checking the URL!
Thinking back, I don't even think I created two accounts with the same passwords at the same time. I think I've changed my Live password in the last few months and just happened to reuse the old Battlefield Heroes one - I only played the game once so forgot I even had an account. Either way, freak coincidence or not, what an epic pain in the tits. I'm overdrawn now!
Just off the phone to MS and the chap confirmed my case has now been 'flagged for priority', whatever that means. Fingers crossed. I can't get on Live, just as I have time from work to get stuck into Forza 4 and MW3!
Thinking back, I don't even think I created two accounts with the same passwords at the same time. I think I've changed my Live password in the last few months and just happened to reuse the old Battlefield Heroes one - I only played the game once so forgot I even had an account. Either way, freak coincidence or not, what an epic pain in the tits. I'm overdrawn now!
Just off the phone to MS and the chap confirmed my case has now been 'flagged for priority', whatever that means. Fingers crossed. I can't get on Live, just as I have time from work to get stuck into Forza 4 and MW3!
Happened to me last week too. Going to call up today for an update, but I was notified when a stream of e-mails for purchases appeared. I quickly logged on and changed the password, but my account is currently locked whilst they investigate.
I think they've got in as I used the same password for the BF3 Battlelog as my Xbox account, so it looks like an EA breach again.
They've said it could be 28 days before I can use the account again, so I'm currently playing Zelda on the Wii instead.
I think they've got in as I used the same password for the BF3 Battlelog as my Xbox account, so it looks like an EA breach again.
They've said it could be 28 days before I can use the account again, so I'm currently playing Zelda on the Wii instead.
I have to say, I found Microsoft 'support' to be the most frustrating, obstructive, stonewalling bunch of aholes I've ever come across when trying to sort out a warranty issue with a RROD'd ExBox. Uterly useless and unhelpful and acually made me feel like a Criminal for daring to try and return a broken console in the warranty period.
I really hope you have more joy than I did.
Like a mug I bought another console (for Forza 3). Which RROD'd within 30mins.
holes I've ever come across when trying to sort out a warranty issue with a RROD'd ExBox. Uterly useless and unhelpful and acually made me feel like a Criminal for daring to try and return a broken console in the warranty period.I really hope you have more joy than I did.
Like a mug I bought another console (for Forza 3). Which RROD'd within 30mins.
I currently keep on getting emails from Xbox live saying that my cc details are incorrect - they have my correct name (ie. Dear "John Smith") and state that my card type "Visa/Mastercard" isn't working - they state the type but no numbers (the XXXX bit on the end).
It provides a link to https://billing.microsoft.com which looks valid.
The thing is that when I fire up the Xbox I am not seeing anything like this in my XBL inbox which I would expect.
Anyone else seen this happen? Or is this a real email? I'm fked if I'm clicking a link in an email!
(This proves the extent of current paranoia - I've been in IT (as a development contractor bod) for 20 years now and even I don't know if what I'm seeing is real. So sick of these thieving bds 
ETA: just manually gone to Microbesoft billing and my card had indeed expired. Sorted. Such is paranoia, eh?
It provides a link to https://billing.microsoft.com which looks valid.
The thing is that when I fire up the Xbox I am not seeing anything like this in my XBL inbox which I would expect.
Anyone else seen this happen? Or is this a real email? I'm f
ked if I'm clicking a link in an email!(This proves the extent of current paranoia - I've been in IT (as a development contractor bod) for 20 years now and even I don't know if what I'm seeing is real. So sick of these thieving b
ds ETA: just manually gone to Microbesoft billing and my card had indeed expired. Sorted. Such is paranoia, eh?
Edited by Dog Star on Monday 28th November 14:11
Dog Star said:
I currently keep on getting emails from Xbox live saying that my cc details are incorrect - they have my correct name (ie. Dear "John Smith") and state that my card type "Visa/Mastercard" isn't working - they state the type but no numbers (the XXXX bit on the end).
It provides a link to https://billing.microsoft.com which looks valid.
The thing is that when I fire up the Xbox I am not seeing anything like this in my XBL inbox which I would expect.
Anyone else seen this happen? Or is this a real email? I'm fked if I'm clicking a link in an email!
(This proves the extent of current paranoia - I've been in IT (as a development contractor bod) for 20 years now and even I don't know if what I'm seeing is real. So sick of these thieving bds
ETA: just manually gone to Microbesoft billing and my card had indeed expired. Sorted. Such is paranoia, eh?
Yep i've been getting these too but i have however recently had a new Visa debit card, so i was wondering if this was the reason. It provides a link to https://billing.microsoft.com which looks valid.
The thing is that when I fire up the Xbox I am not seeing anything like this in my XBL inbox which I would expect.
Anyone else seen this happen? Or is this a real email? I'm f
ked if I'm clicking a link in an email!(This proves the extent of current paranoia - I've been in IT (as a development contractor bod) for 20 years now and even I don't know if what I'm seeing is real. So sick of these thieving b
ds ETA: just manually gone to Microbesoft billing and my card had indeed expired. Sorted. Such is paranoia, eh?
Edited by Dog Star on Monday 28th November 14:11
Gassing Station | Video Games | Top of Page | What's New | My Stuff