Some weird stuff going on...

[goombakid]

2016, for me, has started to be a shitfest with paranoia set in for good measure.

Lemme explain.

About 2 weeks ago, I logged into my bank account to check balance and pay some bills. I noticed that there was a charge to an automotive place in NJ for a little under $10. I don't recall buying auto part in NJ, and if I get any auto parts, it's usually sourced locally.

So I called the bank about it and they say that the charge was done on my wife's debit card, so she had to call the bank and get it all squared away, getting a new card and putting in a fraud report and whatnot.

Told my wife about it, and she thought that was weird. She always tells me when she's using the card attached to the account, and she was sure as shit didn't use it for auto parts in NJ. She stops by the branch that's pretty much the next building from where she works and got it done.

Forward a week later. I log into my account again to check if the reversal was done or there are any pending messages for me. I see another charge done...for about $150 or so...at a Woolsworth...in AUSTRALIA! Lucky I caught it early in the morning. I guessed that it was my card, so I went into the bank that morning and did the same thing my wife did the week before.

Thing that sucks is that I'm gonna have to wait anywhere from 10 to 90 days (dumb number, I know), for the money to get back into my account.

It's now the end of January. This morning I'm welcomed to an email from Netflix (well, 2; one in Spanish that was sent first, then an English one). The email mentions that I changed my password...like fucking hell I did! I clicked on the link in the email, then my phishing sense kicked in. I closed the tab, opened a new one and typed the URL in. I was able to log in with my old password, but I figured that if I got that email earlier, I should just change my password anyway. After changing it, I logged out and logged back in to update my account with my new card that I got on Friday.

My wife logged into Netflix tonight onto her profile. In her "Continue Watching" queue, there were 2 shows that she knows she didn't watch...one was House, M.D. and the other some kind of telenovela show.

...fuck...

I logged into Netflix again on my computer and checked who logged in the account. It looked like there were 4 different IPs that connected to my Netflix account...in COLUMBIA!

I notified Netflix CS about it and was done.

For about the past 2 hours or so, I've been changing all the passwords that have sensitive information at them. Fucking crazy.

I'm at the point where I might start looking into something like LifeLock, unless someone has a better alternative to that.

 

[ballzdeepx]

Keep a separate password for everything, every account you have. If there is two factor authentication available, use it.

Manage them in a spreadsheet or use a password safe application but this will reduce your risk big time if you use secure strong passwords or phrases. The phishing part is a bit more involved as its common sense coupled with vetting headers etc.

Bottomed line if you didn't change your pw, it's most likely a phishing attempt.

 

[xsq]

is your PC safe?

 

[mr_b]

Get a credit card and get off debit cards whenever possible. Giving people access to your real money is foolish in today's world. By using a credit card, you protect your money for 30 days plus you will earn points for travel, cash, whatever.

 

[oliverclaude]

That's awful. What internet security software are you using? True, they exist partly to make government infiltration a breeze, still better them, than some ordinary hackers doing pricey trolling on your account.

 

[goombakid]

I never assume my PC is ever safe, but I guess I've let my guard down.

What security software do people suggest? I've just been using Windows Defender and Malwarebyte's Anti-Exploit.

Keep a separate password for everything, every account you have. If there is two factor authentication available, use it.

Manage them in a spreadsheet or use a password safe application but this will reduce your risk big time if you use secure strong passwords or phrases. The phishing part is a bit more involved as its common sense coupled with vetting headers etc.

I've gone super old skool and I'm keeping my passwords written and hidden.

 

[madman]

That's awful. What internet security software are you using? True, they exist partly to make government infiltration a breeze

100% horse shit.

 

[lolifoxgirl]

The government does not send netflix account details to columbia. Or do they? Sorry about your trouble goomba.

 

[NeoSneth]

Change passwords every 3 months. That will resolve 90% of issues unless you have someone tracking your every move.

password strength is not that important. words, letters, symbol. Doesnt need to be complicated.

 

[DNSDies]

Piece of advice:

NEVER EVER use your card at a gas station unless it's a gas station card or disposable card. The clerks there are not trustworthy, and they do gather credit card information to sell online. I made the mistake of using my card to get a soda at the gas station near my home, and 3 weeks later, there was a suspicious charge on it for $10 from that same gas station (I think the guy was testing his card collection before selling the info)

Luckily, my card provider monitors my purchases and this was made outside of my normal schedule, so they put my card on hold and notified me via text and sent me a new one the next day.

 

[Neodogg]

PM EG to tell his buddies to lay off!

 

[Naika]

That's some weird shit right there.

 

[ki_atsushi]

If you do use a debit card, run it as credit. Never put your pin number in anything. Card skimmers are becoming very popular with thieves nowadays.

Speaking of skimmers, be sure to give a tug even on your ATM card slot, thieves are starting to install skimmers on those too, combined with little cameras and fake button pads too, so they can see your key presses. Be sure to test your banks ATM's even!

 

[F4U57]

Thanks for the beers

 

[Cylotron]

1. never use the same password for anything
2. never save passwords on your pc (the old fashioned 'write it on a piece of paper, keep it in your room' works better)
3. never click on account related links in an email (go directly to the website and login to your account to verify what the email was about - or call)
4. use a browser with good adblockers (opera, chrome, firefox)

 

[bloodycelt]

1. Use something like 1Password for accounts that do not store financial data.
2. Remove as much of your credit card from online stores, etc as you can. Use Gift cards instead for things like PSN or Steam or Amazon.
3. Use Cash where you can.
4. In regards to #1, use randomly generated unique passwords for each website you go to. Just don't do this for your bank or your email account. Those use two factor auth via text messages or a phone app.
5. Use a junk computer running linux or a WiiU to view your porn. Stop watching porn on any device that has sensitive information.

Now what really sucks is most Bank websites use javascript, otherwise I'd suggest removing Java, Flash, and disabling javascript. I would still recommend Firefox as a browser if you can. And whatever email client you use, disable loading images and disable HTML. Both of those can be used to load executable code as your mail client is trying to parse the image or html and render it. You can still download the image as an attachment if you trust the sender.

 

[Alpha Skyhawk]

1. Use something like 1Password for accounts that do not store financial data.
2. Remove as much of your credit card from online stores, etc as you can. Use Gift cards instead for things like PSN or Steam or Amazon.
3. Use Cash where you can.
4. In regards to #1, use randomly generated unique passwords for each website you go to. Just don't do this for your bank or your email account. Those use two factor auth via text messages or a phone app.
5. Use a junk computer running linux or a WiiU to view your porn. Stop watching porn on any device that has sensitive information.

Now what really sucks is most Bank websites use javascript, otherwise I'd suggest removing Java, Flash, and disabling javascript. I would still recommend Firefox as a browser if you can. And whatever email client you use, disable loading images and disable HTML. Both of those can be used to load executable code as your mail client is trying to parse the image or html and render it. You can still download the image as an attachment if you trust the sender.

I use Firefox and the Noscript and Adblock Plus add-ons, and I can browse all the porn I want.

The more astute piece of advice would be to not browse porn on Internet Explorer. Especially an IE that hasn't been updated in half a decade.

 

[bloodycelt]

I use Firefox and the Noscript and Adblock Plus add-ons, and I can browse all the porn I want.

The more astute piece of advice would be to not browse porn on Internet Explorer. Especially an IE that hasn't been updated in half a decade.

I forgot about Noscript. Yes that would work as well, so long as your not absent-minded and forget you turned it off because you wanted to use Netflix.

 

[Tripredacus]

It looked like there were 4 different IPs that connected to my Netflix account...in COLUMBIA!

The space shuttle?!

 

[xelement5x]

Get a credit card and get off debit cards whenever possible. Giving people access to your real money is foolish in today's world. By using a credit card, you protect your money for 30 days plus you will earn points for travel, cash, whatever.

Yeah, I agree. There is no reason to use a debit card for anything anymore if you can get a CC squared away. Sure it's a bit of a pain with one more thing to look at/pay but it's worth the extra security.

 

[Alpha Skyhawk]

I forgot about Noscript. Yes that would work as well, so long as your not absent-minded and forget you turned it off because you wanted to use Netflix.

Turn it off? You can whitelist websites. It's the default way to use the add-on. I don't turn it off specifically for Netflix or anything else.

 

[aoiddr]

4. use a browser with good adblockers (opera, chrome, firefox)

I'll raise you one higher... you don't really even need an adblocker at all if you block the ads in your HOSTS file itself.
I use this site's list: http://winhelp2002.mvps.org/hosts.htm