3 ms·
> The scam is operating on the chance that James does not realize that it is someone else's Netflix account and goes ahead to add funds to it. Right, but keep
by Lazare 9y ago
> The scam is operating on the chance that James does not realize that it is someone else's Netflix account and goes ahead to add funds to it.
Right, but keep in mind that he's already changed the password.
> The other person then logs in
How? They don't know the new password.
The timing doesn't seem to work; James can't add funds without resetting the password, and Eve can't hijack it without knowing the new password. There's a potential loophole if Netflix 1) doesn't invalidate the old session when the password changes and 2) doesn't require a user to provide the current password for changing the email but as far as I'm aware, that isn't the case. (It certainly shouldn't be! And if it is, then that's the real issue here...)
- brisance 9y agoThe perp can regain access to the account by using alternative forms of account recovery in the account management settings, which the user would unlikely notice if he doesn't suspect anything amiss. e.g. an SMS password reset link sent to a phone number the perpetrator controls, or a secondary email address.