After my Paypal account got hacked I thought I had secured everything but it seems that this was not the case, on 7th April 2011 I got an email (two of them) telling me that I had gifted The Metallica Collection to email@example.com & firstname.lastname@example.org at a cost of $99.99 each, both of which had left my credit card at 2:52am UK time. I started the process as soon as I work up, calling Amazon and getting this stopped dead in it tracks. I learned a few lessons here I think and I shall detail the process to locking down any future exploits.
Dealing with Amazon
I live int he UK, I created only a UK Account (amazon.co.uk) and like most people had bought things from Amazon and used a credit card. I know some sites when I use my credit card that an additional pop-up from my credit card provider comes up asking secret questions only I know the answer to and it seems Amazon does not do this. I want to go over a few points before people start to say “your account was phished by a bogus email” or “Your password was weak”. If I ever get an email from any site that I use money on emails me, I always open a browser and go to the site myself, never do I click on an email. Secondly my passwords are generated from an site that makes the password so complex that I have a book that I use to write them down, of course Google Chrome and Firefox Saves these passwords for me.
I Called Amazon in the UK (Free to call) but of course the problem is not with the UK branch but the USA and by sheer luck they pass me through to the USA side and they tell me at this time (in the USA) the MP3 Dept is closed but they will log a call and get this sorted within 24 hours, I should then close my account down (they advise) plus .com and .co.uk sites are not linked at all.
24 hours later
The only email I had come across from Amazon is how to close my account, I did not want to do this yet so I started to figure a way to call them and get this sorted. I changed my password on the UK site and sure enough the USA one was also changed, so your Amazon account (regardless of what the person told me on the phone) is linked and had I deleted the USA one, the UK one would also be closed. I had yesterday anyhow removed my credit card from Amazon so no more purchase can me made but I needed to get to the bottom of this.
I called the UK branch again, I got an Indian call centre who had trouble understanding my email address and the order numbers and of course could not find any record of them (as she was checking the UK side). She would not put me through and advised me to call the USA telephone number (which would have cost me a lot of money).
Calling the Credit Card Company
As I was getting nowhere with Amazon, I called my Credit Card Company, I advised them to send out a dispute form and also stop the current card and issue a new set with different end dates and such. What this would do is make all instances of the current card null and void anywhere I have used it on-line, this would stop any further uses of the card period.
I wondered if I was able to Call USA TOLL FREE Numbers via Skype? I tried this and it worked just great, I was on the phone to the USA MP3 Dept and sorting the issue out swiftly. It seems that they had already cancelled the order and were launching an investigation to trace who had downloaded the MP3, once they get the information, as this is fraud, they will go after the person with the full force of the law but they were unable to tell me how, when and why this all happened.
Clearing up the aftermath
I thought back to what sequence of events had happened just before this occurred. I have scanned my computer and have various measures in places and it seems I was clean but you cannot rule this out. I had fired up Chrome to check Adsense which I hardly use and this stores Passwords with no encryption.
How to move forward? Well this is easy but time consuming. To start with as I have mentioned, I have stopped the current credit card and getting a new one, this means if it is is logged on any other site they will not be able to use it. To make sure that none of the computers has something planted that is stealing my passwords (no matter how complex) – I am wiping them and rebuilding from scratch, this not only secures the computers but makes them a lot faster to boot.
I will go through every single site I can think of and change my password, making then so complex that I am indeed using a paper based book to write them down. I will not install Google Chrome again as this stores all your passwords in plain text, not good. II have already closed down PayPal and soon I will close down Amazon. My Advise to anyone is a simple one, once you have used your credit card on-line to buy something, remove the card afterwards – this will stop money from leaving your card. I am seriously thinking of not buying on-line as it seems no matter how secure they all claim to be, this is proving false.