quote:

I was able to change the password and the email in the profile and the shitbags gig was up. With no one out any money thankfully.

Thankfully he never changed my password. Would have likely been more complicated to get things fixed and people warned.

quote:

Originally posted by chellim1:
So how did he get your password?

• Since forums like SIGForum do not have much personal information and it's not banking-related or an online store, folks may think it's not worth it to have a good password. For those sites you think are low risk, do you use the same easy password?
  
• People use the same password - and in many cases the same username - for many sites. If a username and password are figured out elsewhere, crawlers will find the same username and try that password on other sites. You can't imagine how sophisticated these criminals are with their databases, matching up usernames, email addresses and possible passwords.
  
• Phishing emails.
  

• Use a unique password or passphrase for every site. Yes, this sucks, but it is what it is. (I easily have 200+ passwords and need to use a password manager. I use LastPass, but there are others.)
  
• Expect to see more implementation of two-factor authentication everywhere. This could be the implementation of something like Google Authenticator, which requires an app on your phone, verification codes sent to your email (not super-secure if your email is compromised), or text codes to your cell phone (costly for the host).
  
• Be suspicious of emails sent to you. The phishing emails (that try to get you to "log in" to your "account") are becoming increasingly difficult to recognize. You might click on the button/link and enter the username and password, and then nothing happens. You drop the issue and think it's no big deal, but you've just given them your username and password and confirmed the email address. Since many folks use the same password, they start checking other sites.
  

quote:

They wouldn’t want to enter banking or card info.