Marketplace
Hi,
Just wanted to share how my identity information was used in attempts to gain access to my bank accounts and what role ebay security played here.
Someone broke into my house and took my passport along with other things.
About a week later I received a very strange SMS from my bank asking me to come to their branch. They said that someone called and tried to get details about my account but they couldn't. As a part of security process bank asked them a number of questions and they answered correctly to most of them except my phone number. Bank then asked to provide info about recent transactions on the account. Thieves then provided some transactions info which didn't match with what my bank account had which is good. But what struck me the most is that these were valid transactions from my other bank account. A person with whom I spoke at the bank recommended to check my ebay and paypal accounts. I tried to login to my ebay account straight away and couldn't. Wrong password.
Essentially what happened is thieves called ebay and managed to get my user ID and reset my password over the phone. They then tried to use recent transactions from my ebay account as a part of authorisation process for bank. I called ebay as soon I realised what have happened and changed my password. I use password manager and very strong passwords on all my online accounts. I haven't received any email message or SMS that there was a password reset on my ebay account. The only place where this was mentioned is ebay internal messaging system. Later I called ebay again trying to investigate HOW they managed to reset my password without having access to my phone and email address. I didn't get enough details from them. All they said that someone called and requested password reset and successfully went through security check. They said the only way they were able to reset my password is if they had access to my email account. I have a pretty high confidence that none was able to access my email account. I have a very strong password, 2 factor authentication and I didn't see any suspicious activity in my emails. For sure they would exploit access to my email if they had it.
Key takeaways:
Hide and protect your identity information and documents as much as possible.
Don't rely on false sense of security when you use strong passwords and two factor authentication. Anyone with enough info about you can port your number and have access to your account.
Check your ebay account and make sure you have max security enabled such as security questions and 2FA. I stopped using ebay completely and considering not using it anymore. I believe they have very bad security checks.
Stay safe people!
This is from someone that left a primary id unsecured enough for someone to steal. The thieves then managed to answer almost every challenge questions.