Someone is registering accounts with my email address - advice wanted

[enjay]

Someone out there in Internet Land has realised my (personal not school) email address is a real one, and is using it to sign up for dating websites, "lonely Russian girls want to chat to YOU" websites and so forth - presumably because they don't want to avalanche of junk email and/or don't want their partner to find out. Given my position in education, I don't want any association - however small - with these websites as I think some of them border on the kind which could cost me my job if I were actually using them. So, should I just ignore these and delete the emails, or reset the passwords so I can log in and close the accounts?

 

They also created a PayPal account against my address, added loads of (presumably stolen) cards then did something which caused PayPal to freeze the account - worrying you can do that all without verifying the email address (why send out those "please verify your address" links if you can do all this without it?), but that's another conversation.

 

Oh, they tried to sign up for Netflix on one of the dodgy cards too. I've reclaimed the Netflix account by requesting a password reset, as I might actually want to use that myself at some point (currently my Netflix is on Mrs Enjay's email address).

[CCCSecMan]

Are you completely sure your account hasn't been compromised? Most of these websites you mentioned (if not all) require you to click the registration link for the accounts to actually activate. So either

 

-Your account has been hacked - in which case yes you need to change all your passwords.

 

Or

 

-These are spoofed emails and aren't genuine in the first place

-Someone is registering using your email address and the websites aren't checking the address actually belongs to them.

 

If it is the last two, then just ignore it, anyone can type in your email address, that is the nature of the internet, and there is nothing you can do about it nor is it your responsibility to advise incompetant websites who fail to do proper checks that it is a bogus registration.

 

You could advise your colleagues or IT team just so they are aware, however just because you got dodgy emails doesn't mean you did anything dodgy, hopefully they know this!!!

[Ditto]

I think if it were me I'd be advising the DSL and line manager immediately. It'll be a right pain, but I'd also look to move to a new email address. I'm also still trying to fathom out what the perpetrators goal is. Could it it be purely mischievousness or do you think there is something more to it?

[Ditto]

-These are spoofed emails and aren't genuine in the first place

Certainly worth checking on this.

[enjay]

Yes, I'm confident my account hasn't been compromised. It is a Google account with 2FA and alerts for logins from unusual places enabled.

 

I'm also confident they're not spoofed emails. The headers look correct, plus I was able to confirm accounts have definitely been created at PayPal and Netflix using the email address. Of course, that incident might be unrelated to the dating websites as the PayPal account wasn't even created from within the UK, but the dating sites are all UK-based.

 

As for most of the websites I mention needing confirmation of the email address, I'd ask how you know that! You're right that Paypal sends an email address verification link, however having spoken to them about it, you are apparently able to make transactions from an account even before it has been verified!

 

As to why someone might be doing it, I don't believe it to be mischievous or malicious towards me as I don't think I've offended anyone who has my address recently, nor have I had a run-in with a student who might fancy trying to find it out and then do this. I suspect it is someone who doesn't want the activity to link back to them.

Edited January 11, 2019 by enjay

[David44]

Ignore it. Not your problem.

[MatthewL]

Might be worth checking your account on Have I Been Pwned.

[CCCSecMan]

As for most of the websites I mention needing confirmation of the email address, I'd ask how you know that!

Maybe I use Russian Dating sites? I don't think looking at dating sites is a crime.

 

You're right that Paypal sends an email address verification link, however having spoken to them about it, you are apparently able to make transactions from an account even before it has been verified!

That is true but they shouldn't be able to have a fully functioning account without verifying. It simply is not allowed. If all of these accounts have been registered using your email address then unless gmail or paypal themselves have been hacked then someone has been able to read your mail or at least obtain the verification links.

 

As to why someone might be doing it, I don't believe it to be mischievous or malicious towards me as I don't think I've offended anyone who has my address recently, nor have I had a run-in with a student who might fancy trying to find it out and then do this. I suspect it is someone who doesn't want the activity to link back to them.

This happens all the time - whether someone has done it deliberately or not, honestly as long as you are sure your emails aren't being read then you should not worry about someone messing about trying to use your email for something.

The other possibility which you might not be aware of is that Google will direct emails from one address to another if the email is listed as a recovery email address. Are you absolutely sure the email is being addressed to you?

[jthompson]

I know that Instagram, for instance, allow users to sign up and start using their account without the email address verification being completed (I know because my personal email account has been used as such, but Instagram don't let anyone delete accounts. Grr). However, I think PayPal will come down more strictly in that regard. Their domain will be well protected against spoofing, too, provided the receiving email server is processing dmarc policies (if your email server is not, then your account could indeed be accepting spoofed PayPal emails).

[ZeroHour]

Just a side note: I would possibly sign up to ClearScore etc for free credit monitoring just as a peace of mind. ClearScore covers one credit rating agency, https://www.moneysavingexpert.com/creditclub covers Expedia and Noodle covers the third, all are free although Noodle does have optional paid things as well.

[mikeprice]

I would tell Paypal about it ASAP - if this account is labelled as yours - with your address then it could affect your credit rating etc - hence making life hard if you need to borrow money (e.g. I was once turned down for a Buy Now Pay Later deal!)

 

And keep a check on you credit record using one of the free services - just to make sure that no records of new account appear that shouldn't be there

 

And - obviously - I would change your passwords ASAP

[enjay]

Maybe I use Russian Dating sites? I don't think looking at dating sites is a crime.

 

You're right - looking at dating sites, Russian or otherwise, isn't a crime. Looking at websites which hint at linking you with teens in your area who want sex is, or could at least cause some awkward conversations for someone in our line of work.

 

That is true but they shouldn't be able to have a fully functioning account without verifying. It simply is not allowed. If all of these accounts have been registered using your email address then unless gmail or paypal themselves have been hacked then someone has been able to read your mail or at least obtain the verification links.

 

PayPal told me you can add cards before the account verification link is clicked, I think they said you can also make purchases too. In this case, the verification link was never clicked. I don't just mean I didn't click it, PayPal told me the account hasn't been verified.

 

I know that Instagram, for instance, allow users to sign up and start using their account without the email address verification being completed (I know because my personal email account has been used as such, but Instagram don't let anyone delete accounts. Grr). However, I think PayPal will come down more strictly in that regard.

 

Oddly not. PayPal also said they cannot delete accounts once created, citing GDPR (I decided not to contest that one with him!). I asked if they could lift their block on the account so I could use it, but they also said no because I couldn't prove I am the owner of the email address over the phone. I suggested they could send a password reset link to the email address, but also no. So now my email address is permanently blocked at PayPal.

 

I would tell Paypal about it ASAP - if this account is labelled as yours - with your address then it could affect your credit rating etc - hence making life hard if you need to borrow money (e.g. I was once turned down for a Buy Now Pay Later deal!)

 

That was my thinking too - especially if PayPal were to merge with a company I genuinely use, at which point the flagged email address might be an issue - but PayPal assure me this will not reflect against me, in part because the account was never verified. The PayPal account only has my email address linked, not my postal address.

 

 

PayPal saying the fact the account hadn't been verified worked in my favour is what set me thinking about all this. Part of me thought "I should verify these accounts, so I can then close them" but now I'm less sure. Hence this thread!