4 ms·

Something similar happened to me a while back. I noticed that several smiley face/emoticon applications had been downloaded using my account. They removed my

Something similar happened to me a while back. I noticed that several smiley face/emoticon applications had been downloaded using my account. They removed my credit card from my account and drained my iTunes gift card. Apple caught the problem and e-mailed me to ask if it was me. I told them no. They disabled my account, refunded the gift card money, and asked me to write them once I was satisfied that my computer was secure (just in case it was key-logged [I was not].) I wrote them back the next day and told them everything was good to go. They enabled my account and I signed in and changed my password. I didn't lose any of my purchased items and I could have had the account back the same day had I chosen to. I recall a while back that there were quite a few iTunes accounts that had been compromised. I used a very non-trivial password, too, so I'm rather surprised that mine was one of the compromised accounts. I'm still curious as to how it happened.

jobu 15y ago
I've only made multi-item purchases from iTunes a few times, but every time I've gotten a call from my credit card company within a couple hours. The last time they said that it's become so common for fraudulent activity on a card to start with a "run on iTunes", then move on to other online sites if the card still works. The only thing I would recommend to Scott Hansleman is to drop PayPal. They can be easier for small donations online, but with how far behind the curve they are in consumer fraud protection I refuse to make purchases with paypal anymore.
- sprovoost 15y ago
  There's a difference between someone using your creditcard to buy stuff on iTunes with a different iTunes account* and someone using your iTunes account to buy apps. In your case I'm guessing they did the first thing. * = possibly not their own; they might own the apps that you're buying or make money through affiliate networks. And of course they could buy gift cards with your cards and sell them on eBay through another payment account.
ajross 15y ago
No doubt because you reused the non-trivial password and someone read it out of a stolen database. Password strength is a red herring. Password reuse is a far bigger problem then weak passwords.
- robflynn 15y ago
  It was a password that I only used with iTunes, or at least, I thought it was. You may be correct. I'm more vigilant with my passwords these days.
  - sprovoost 15y ago
    Only one way to find out; go through all your accounts and try that password. Let us know... Even if the password was unique to iTunes, a key logger on your computer could have intercepted it. Does Apple always use HTTPS? Otherwise it might have been intercepted when you were on an insecure wifi network.
- CamperBob 15y ago
  Passwords in general are horribly broken. They're the worst conceivable way to authenticate, except for all the others. Solve this problem and you'll be the next Verisign, if not the next Microsoft.

jobu 15y ago

I've only made multi-item purchases from iTunes a few times, but every time I've gotten a call from my credit card company within a couple hours. The last time they said that it's become so common for fraudulent activity on a card to start with a "run on iTunes", then move on to other online sites if the card still works. The only thing I would recommend to Scott Hansleman is to drop PayPal. They can be easier for small donations online, but with how far behind the curve they are in consumer fraud protection I refuse to make purchases with paypal anymore.

sprovoost 15y ago
There's a difference between someone using your creditcard to buy stuff on iTunes with a different iTunes account* and someone using your iTunes account to buy apps. In your case I'm guessing they did the first thing. * = possibly not their own; they might own the apps that you're buying or make money through affiliate networks. And of course they could buy gift cards with your cards and sell them on eBay through another payment account.

ajross 15y ago

No doubt because you reused the non-trivial password and someone read it out of a stolen database. Password strength is a red herring. Password reuse is a far bigger problem then weak passwords.

robflynn 15y ago
It was a password that I only used with iTunes, or at least, I thought it was. You may be correct. I'm more vigilant with my passwords these days.
- sprovoost 15y ago
  Only one way to find out; go through all your accounts and try that password. Let us know... Even if the password was unique to iTunes, a key logger on your computer could have intercepted it. Does Apple always use HTTPS? Otherwise it might have been intercepted when you were on an insecure wifi network.
CamperBob 15y ago
Passwords in general are horribly broken. They're the worst conceivable way to authenticate, except for all the others. Solve this problem and you'll be the next Verisign, if not the next Microsoft.