Identity theft - am I a victim?
 

I just got home from work and read my Hotmail email. I had one from Amazon saying that suspicious activity had taken place and that my account was put on some kind of hold. Being used to PayPal and Ebay fraud, I overlooked it and figured it was a scam. Until I saw my next email.

It was an email from DPReview.com, an well-known digital camera review site. The message was to inform me that my account was put on a temporary hold because someone had tried to log into account (basically it's just a talk forum) and done so with incorrect information more than 5 times.

This is definitely no coincidence. Any idea what's going on? Why would someone be trying to access sites that wouldn't have any of my credit card, social security info, etc such as DPReview? I would guess Amazon since they could order stuff, but now I'm just confused. Are there maybe types of "stupid" computer bots that take any and all websites that I access and try my usernames in hope to find valuable info?

Also, DPReview interestingly sent me the IP address of the computer that was doing the attempted logins. I'll post it here when I get an OK from the mods (not sure if it'd be ok or not), thouh an IP search took me to ThePlanet.com, "dedicated servers and web hosting" in Texas.

Thanks for any advice.

Actually, given the prevalence of the style of e-mail phishing you got regarding the Amazon account, I would think it was just a coincidence. Regardless, I'd say that you were a target of identity theft, not a victim because it doesn't sound like they got any of your information. Do you use the same user-id/e-mail between Amazon and DPReview?

BTW: I'm currently editing a book on the subject of protecting yourself from identity theft.

Interesting indeed, thanks for the reply. And no, I'm pretty sure I don't use the same user ID for the two sites, however they are attached to the same email.

So spoke with customer service at ThePlanet.com and am currently working with their abuse team via email. They're asking for quite a lot of information unfortunately:

"Please note that we are unable to proceed our investigation without logs detailing the activity in question. Please provide a text log, including date time stamp (with time zone relation to GMT), source IP and port and destination IP and port."

I went ahead and just sent them the entire emails, IP, time, and date included.

well if its a phishing scam email, look at where the links in the email actually take you, in a phishing scam the links wont be to the correct address I get some pretending to be ebay, but the links go to some ip address that has a clone of ebays page.

It might be a silly question but have you been to amazon.com and checked the status of your account? If it's active the email was phishing. It's very possible someone that doesnt visit DPreview often thought that your usename was theirs. I know I've gone to plenty of sites that I have an account at and typed in cybermike and tried every pass I know of before giving up. Then after checking old emails or having my account/pass sent to my registered email I learn that cybermike wasn't even my account name on that site.

The thing is the sites are only connected through your email address. They don't have the same account name and the only way anyone would know you own both of them would be to get into your email and view emails where you signed up. The thing is, if they had your email adress why did get the password wrong 5 times in dpreview? dpreview most likely sent your pass to you in an email, and even if you deleted it, they could have just hit recover pass and had it emailed. While I can't prove they are both nothing to worry about, I just don't think they are connected.

it does sound like you may be a victim

I can check for sure if you'd like. I would just need your social security number and a couple bank statements.

If you think there is an issue you should place a fraud alert. You should also file a police report, a complaint with the the federal trade commision, and close any accounts that may be affected. And you should definately check your credit report.

Numbers to call to place a fraud alert (not sure if calling only 1 works or not):
Equifax - (800) 525-6285
Experian - (888) 397-3742
Social Security - (800) 269-0271
Trans Union - (800) 680-7289

I never got notice that there were more replies to this thread! Thanks for the recent replies, I'll definitely look into those.

I came back because I just got another email from DPReview for the same reason. This time, the IP address linked not to the web hosting service in Texas but to a place called "TELKOMNET" in Jakarta, Indonesia. Oh dear.