from Hacker News

Ask HN: Someone is using my email to register to a bunch of services

by avitzurel on 4/23/20, 6:42 PM with 6 comments

Hey all,

In the last 20 minutes, I got probably around 200 emails congratulating me on registering to the website/newsletter.

This is my personal email

In addition, my credit card has been used to purchase 850$ worth of goods (called Amex, canceled the card).

I changed my email password obviously, canceled the card.

What else can I do? Did this ever happen to you? Have any advice?

  • by avitzurel on 4/23/20, 7:12 PM

    I am posting some information here in case someone encounters this.

    This seems like a type of DDOS attack to hide an email from a financial service.

    All of these emails are essentially meant to hide the order of 850$ in the flurry of other emails.

    Some information from a Google thread: https://support.google.com/mail/forum/AAAAK7un8RUCTPjR3thcdQ...

  • by jamil7 on 4/23/20, 6:52 PM

    You can check something like https://haveibeenpwned.com/ to see if you can locate where the breach came from. Other than that you just have to assume the worst and start rotating all your passwords and keys. Turn on 2FA for everything.

  • by johnnyo on 4/23/20, 6:58 PM

    I knew a guy who had a very common email address (like jsmith at popular provider), and it was pretty common for people to sign up to services using that address.

    For well designed sites that require verification before the account is setup, just trash the message.

    For other stuff, you may have to unsubscribe.

    Worst case scenario for something like a dating sites or whatever, you can just reset the password, then login and delete/deactivate the account.

  • by duxup on 4/24/20, 2:20 AM