4 ms·

"Malicious actors can take unauthorized ownership of online accounts even before their victims sign up for services, according to new research backed by the Mic

"Malicious actors can take unauthorized ownership of online accounts even before their victims sign up for services, according to new research backed by the Microsoft Security Response Center (MSRC)." "In their study, the researchers examined 75 services that ranked among Alexa’s list of top-150 high-traffic domains." Ironically, Microsoft accounts seemed to be vulnerable as of last year. I got an email from Microsoft about someone renaming an account linked to my email address - an account I didn't know about. I was never able to recover access as they wanted me to prove I owned the account and whoever had created it had all that info. If anyone in Microsoft is reading this I'd appreciate help sorting this out!

deleted 4y ago
[deleted]
thimkerbell 4y ago
Is there a low-friction way to inform the institution (and have them hear you) that you did not create the account?
- richdougherty 4y ago
  I'd love to know! I got this email. Your Microsoft account has been renamed. We just wanted to check with you that it's okay. - Old account name: <my email address> - New account name: <someone else>@outlook.com If this is correct, you don't need to do anything. If this is incorrect, please follow these steps: 1. Reset your password by going to https://account.live.com/password/Reset 2. Rename your account by going to https://account.live.com/ Neither link worked for me because I couldn't authenticate the account that someone else created. I couldn't stop the account name being changed, even though I had control of the original email address. Later when I submitted a request to reset the account I was asked for more information at this link: https://account.live.com/acsr https://account.live.com/acsr. Again, this required me to know info about the account someone else created. I managed to link my email address to another Microsoft account, but I'm not confident that someone still doesn't have another Microsoft account with partial control of my identity. If anyone has any tips about who to talk to at Microsoft other than an automated system I'd appreciate it!
  - ridgered4 4y ago
    > I managed to link my email address to another Microsoft account, but I'm not confident that someone still doesn't have another Microsoft account with partial control of my identity. I'm not sure I'd rely to much on that new account though. It's easy for me to imagine the first renamed account being banned for fraud and then any "known associates" being banned as well.

deleted 4y ago

[deleted]

thimkerbell 4y ago

Is there a low-friction way to inform the institution (and have them hear you) that you did not create the account?

richdougherty 4y ago
I'd love to know! I got this email. Your Microsoft account has been renamed. We just wanted to check with you that it's okay. - Old account name: <my email address> - New account name: <someone else>@outlook.com If this is correct, you don't need to do anything. If this is incorrect, please follow these steps: 1. Reset your password by going to https://account.live.com/password/Reset 2. Rename your account by going to https://account.live.com/ Neither link worked for me because I couldn't authenticate the account that someone else created. I couldn't stop the account name being changed, even though I had control of the original email address. Later when I submitted a request to reset the account I was asked for more information at this link: https://account.live.com/acsr https://account.live.com/acsr. Again, this required me to know info about the account someone else created. I managed to link my email address to another Microsoft account, but I'm not confident that someone still doesn't have another Microsoft account with partial control of my identity. If anyone has any tips about who to talk to at Microsoft other than an automated system I'd appreciate it!
- ridgered4 4y ago
  > I managed to link my email address to another Microsoft account, but I'm not confident that someone still doesn't have another Microsoft account with partial control of my identity. I'm not sure I'd rely to much on that new account though. It's easy for me to imagine the first renamed account being banned for fraud and then any "known associates" being banned as well.