attempt to change my Rewards info to different name and payment

[bb1web]

Hi all thanks for coming in,

please be aware this is what my private information was changed to:

name: Minhy Tran
ph# 61412125482
address: 69 barnyard drive
Cairns Sheridan 4868

any help would be greatly appreciated. I don't know what to do? should I dump this PC, is that how they are getting this info?

I've run avasti, and nothing came up. checked registy and so far nothing looks out of place.

appreciate your advice and hope i may have saved others my fate.

[TheGooner]

Phone number appears Australian
Name appears to Vietnamese

Interestingly - there is no Barnyard Drive in Cairns
but there is a Barnard Drive with a postcode of 4868 in Cairns

So has someone just put in fake or poorly known addresses?
Or is it a real ddress of the perp?

--------------------------------

Whatever, it's unlikely that they tracked your login details off your PC bb1web especailly if you have scanned and found no trace.

So don't go throwing away that PC yet ...


Possible sources are :
- login tracked from use of a public PC (library / cafe)
- database breach at site
- database breach at another site and you are using simialr login credentials
- inside job from someone who works with you

[pdjoe]

Thats just scarry Steve,

Thank god you cought it before payments went out!

[universal4]

As always Steve, it was nice having a chance to chat earlier although we were concentrating on your problem....

Like I said earlier, I am here to help in any way that I can....and I dropped you a pm over at the GIA with a recommendation or 2.

If you miss me tonight, give a shout tomorrow.

Rick
Universal4

[bb1web]

Well it was Renee at Rewards Affs who spotted this, or I'd never have known in time.

*Thank you Dear.


Thank you both parties that have replied. G, i will take your advice because along with being smarter than myself, I am in agreement because I would think they would have went straight to my QT account and just robbed me there if they had a key stroke thingy (whatever they're officially called lol).


Obviously it wasn't too much of an inside job since Renee spotted it and I would be inclined to think that it odd that I would be the first to choose to rip off at CR considering that at times whether liked or disliked, I'm almost always in there so if I were going to rob someone via just CR, putting aside the fact here are a ton of people who make a ton more money than me ...

(he looks at J and G, but smilingly) ... whom I'd rather pick their pockets than what is in mine, even more so is I am about 5% of what I earned just 2 months ago and perhaps 10% of last month. (bad month for me all around eh?)

Otherwise I'd all over the inside job just because that would seem to be the next most likely ...


....


Um here's another note I have discovered which is I can't get into my email account which thank God, isn't associated with my QT, but it is associated with my CR account, which ... well there ya go.

okay they got in via having somehow known my email password, which yes, could likely be the same as the one at CR (I thought I went around and changed them, I know I DID, at most places so whew! on that.


.......

Okay now I guess I just need figure out one of two things.

if they got my password from another place I used it, .... then it is likely that it has been somewhere I recently joined , or somewhere that either recently hired, or fired, someone who would possibly have access to such things.

boy that's a poke in the eye with a sharp stick because there's a ton of places I need to ask, but it might save someone else if they can spot the problem early on.

my last name is B, so if they went A-Z, I might be one of many to come.

......

If you read the above ...... and you've any same passwords .. perhaps NOW is the time to address the matter if its any place you've sensitive material.

.....


thanks again guys!

[bb1web]

RIck I was headed there next to post same info because I thought maybe aff managers would pay heed at one of the places I post and remember the name to be aware

.....


Nah, you never get off that easy.


Huge appreciation for everyone who has responded, I have a couple more places to warn and then I"ve got a lot of personal stuff to attend.

biggest is figuring out how to fix my email situation. they've locked me out and when it comes to hotmail ... if I had a choice ... I'd truly settle for wrestling with the man eating alligator before doing anything with hotmail. maybe they've gotten better


...........


If I ever figure out more than I've offered, I'll be sure to update. Anyone see any flaws in my thinking please holler up. and thanks.

[CityGuard]

I've checked in our records and it looks like this person is not a GPWA member. We don't have any of the contact details (name, address, phone, or email) in our records.

[Renee]

I did a quick IP check this morning and found a few things...

Apart from you Steve and myself logging into your account, there are 2-3 other locations logged in since start of January.

One (over a few IPs) was from Vietnam and the other 2 (over a few IPs) were from Massachusetts and Pennsylvania.

174.59.218.79 - Pennsylvania
71.233.129.16 - Massachusetts
98.217.103.23 - Mass
75.69.152.160 - New hampshire
123.20.3.253 - Vietnam
203.162.3.154 - Vietnam
118.69.70.14 - vietnam
118.69.70.14 - vietnam
222.253.62.103 - vietnam

My guess is that the person who got into the account is from Vietnam and was trying to fool us by logging in from a US proxy...

Possible sources are :
- login tracked from use of a public PC (library / cafe)
- database breach at site
- database breach at another site and you are using simialr login credentials
- inside job from someone who works with you

If there was a database breach at our site I suspect there would have been more than just this account compromised, as well as logs to show this (I have gone through all the logs and cannot see anything suspect).

My guess is that it would likely be either number 1 or number 3... especially since the culprit has gotten into the hotmail account.

Steve you can do a retrieve account for hotmail.. I helped someone do this before.. I'll see if I can find the info and send it over to you...

I also want to tell everyone again how I come to find things like this...

Every 10 hours I receive a file that tells me which payment methods have been updated. I check all the accounts to see if the email on the payment method matches the one in the profile (which only I can change). If they do not match, or the email on the payment method is not at the same domain (that the affiliate owns) I send an email to the email address in the profile to see what's going on.

In this case, I did send Steve an email, but then realised that it's possible the culprit had gotten into his hotmail, so then called him instead..

The other advantage I have is that because I've been here for so long, I know most affiliate ids off the top of my head... so usually I don't even need to check to know something is wrong. As soon as i saw Steve's affiliate id pop up I thought, why would he be changing his method, and when I saw it was changed to moneybookers I knew immediately that it wasn't right. Then of course I went in and saw all the details in the profile (other than the email address) had been changed.

This is the reason why we encourage affiliates to use DIFFERENT passwords across their accounts and to change their passwords at least once every 1-2 months. It might seem like a major pain in the butt, but speaking from experience (I lost ~7k because of something like this with my paypal account), it's a bigger pain in the butt to have to chase companies that are hard to get a hold of to get your stuff back, whatever it may be...

[CityGuard]

I've checked the IPs and one of them did turn up a GPWA forum account that was banned for attempting to spam the forum. The username was erocladledody. I've sent some additional details via email to Renee.

[universal4]

Great leg work Renee.....uhhhh great legs too....lol

These are just 2 of the many things that make you one the BEST Affiliate Managers we work with....

Your theory about the proxy makes sense and is a good deduction.

Steve, please let me know how that scan turned out....


Rick
Universal4

[Renee]

Great leg work Renee.....uhhhh great legs too....lol

These are just 2 of the many things that make you one the BEST Affiliate Managers we work with....

Your theory about the proxy makes sense and is a good deduction.

Steve, please let me know how that scan turned out....


Rick
Universal4

Not just a pretty face mate

Thanks.

[pgaming]

Steve,
So sorry to hear this happened my hands are full otherwise I would have thoroughly enjoyed being your silent killer. Consider mail containers such as hotmail, gmail, yahoo mail, msn, etc… for what they are, for junk. If you insist on using such email containers be sure to use all the security features that they offer such as, secrete question, double aliases, change password every two weeks (make it very strong), be sure the remember me box is unchecked, do not store browser history and so forth.

Never use the same password twice be sure they are different for every login page. Always assume your PC is infected with something most are. If you work under these assumptions your are more likely to place security high on the agenda.

And there is so much more I would like to say perhaps in private. Dam **** off if you ask me. But will say proxies have a beginning and are usually accessed through Internet Providers who do keep logs. For instance if I accessed a proxy from my location via DSL, Cable, Satellite, Wi-Fi, Cell Phone or whatever the carrier would know others would not. In this sense hiding under proxies is not fool proof.

Maybe Rick will give a hand? Just a precaution be sure your PC is fairly clean.

Very sorry to hear Steve I am sure all will get sorted out.

greek39

[Conrad-Gowild Gaming]

We had the very same guy "OnlineBettingBuddy" try and breach one of our
affiliate's accounts yesterday but thankfully all changes have to be
approved first and IP's are checked and if there's a mismatch on IP's we
contact the affiliate and confirm the changes or revoke the update.

We've had a number of cases already where every attempted breach to
our security was done from within Vietnam so we have now blocked access
to Star Partner from anyone trying to access it from Vietnam to curb this
problem.

The trend is always the same with these guys, they always use MoneyBookers
and they create a Money Bookers account in similar to details found within
the account to try and avoid detection.

[universal4]

You see the problem I have with this is that MoneyBookers knows the true identity of the theif.

Congrats to Conrad for catching this.

Rick
Universal4

[pgaming]

Huge thank you Conrad!

all changes have to be
approved first and IP's are checked and if there's a mismatch on IP's we
contact the affiliate and confirm the changes or revoke the update.

Something other programs should consider implementing.



greek39

[Daera]

I'm sorry to hear this happened to you Steve. It's very scary. I had the same thing happen to me once, and they got into 3 affiliate accounts I had and changed my payment method and email. Rewards, Fortune and Pantasia. Luckily I also caught it right before payments went out, so no harm there.

If you haven't already done so, I'd make a point to go into every affiliate account you have right away and check them, and change the password and email. Do it to the ones you don't make money in as well.

I sure wish we could catch these crooks!

Oh... and now we know why Renee was Best Affiliate Manager 3 years in a row. Well done on your fraud detection Renee! You're the best!

[Renee]

You see the problem I have with this is that MoneyBookers knows the true identity of the theif.

Congrats to Conrad for catching this.

Rick
Universal4

This is true, and whenever this happens we contact Moneybookers and their account gets closed down. Fortunately none of these guys have ever been paid before they do this at our program. Moneybookers does take this very seriously though..

[GamTrak]

This happened to me a few months ago with an account. Same MO, different jerk! It's amazing what some folks will do.

[slotplayer]

I had someone get into an old Yahoo Seach Marketing PPC account yesterday.

I received a yahoo alert that someone deposit $500. At first I thought it was a scam email but a closer look revealed it to be genuine.

The card in the account was fortunately expired but the clown tried to change the expiry date and make a charge.

When that didn't work they entered some poor womans card and deposited $500 off it and set up a bunch of campaigns.

I could actually see the ppc balance decrease with each passing minute, first it read $418 then a few minutes later around $380.

The perp put a phone number in there and when I called it, it was some hotel in Flordia but they never heard of the woman and she was not in the register, so they said.

After a couple of attempts I finally got through to yahoo and they fixed it all. However, the only way I could get an actual person was to pretend I wanted to open a Yahoo SM account.

Whenever I pressed the buttons for an existing account it was an endless loop of options and recorded messages.

Unfortunately, I could not find that lady's phone number to call her directly.

[Conrad-Gowild Gaming]

This is true, and whenever this happens we contact Moneybookers and their account gets closed down. Fortunately none of these guys have ever been paid before they do this at our program. Moneybookers does take this very seriously though..

I can also vouch for Money Bookers on this as well. They don't even bat an
eyelid when it comes to closing down these accounts