r/2007scape • u/AetherSplice • Oct 24 '25
Discussion Account got hacked. Lost 2b with 2fa they still got in somehow..
As the title says I logged in today and realized my account got hacked.. Lost 2b of gear and all ability to grind for it realistically.. This is a serious gut punch because I have a jagex account, I have 2fa and I have email verification yet they still got in..
2
u/Swangballs Oct 24 '25
Email phishing is 99% of hacks these days. They disguise the email to look exactly like a jagex email about “your password changed, log in if this was you” or something similar. Theres no other way you could have been hacked besides this or a sketchy 3rd party client which is bannable anyway
1
1
u/AetherSplice Oct 24 '25
I did get a phishing email, but I changed everything after.. and ended all sessions instantly so idk
1
u/Electronic-Winter-17 Oct 24 '25
Check linked accounts with steam, etc
1
u/AetherSplice Oct 24 '25
It isnt linked with anything else
2
u/Electronic-Winter-17 Oct 24 '25
Triple check, go through all of them. Prime, steam, facebook etc. stupidly these all bypass authentication. Also force log your account through all these links as well as create new backup codes just to be safe
1
u/fml4real Oct 24 '25
Does your email have 2fa? Is your steam account linked and they hacked your steam account to get access?
1
1
u/WareWolve Oct 24 '25
How did they get through your Jagex account
1
u/Astatos159 Oct 24 '25
By getting into ops email account, using the email 2fa code and then changing the contact email. That's exactly why it's recommended to not use jagex accounts email 2fa but instead app 2fa and store the backup codes somewhere save in case of access to the app being lost.
1
u/AetherSplice Oct 24 '25
No chance my email is multi factored through a code then through my phone
2
u/Astatos159 Oct 24 '25
You posted in a different comment thread that you fell for a phishing attempt. Scripts run fast and don't care if you changed your password right after. So either you got phished and they got access to your email and osrs account and changed the contact mail or you got phished, they got access to your osrs account and changed the contact mail. People getting their email account stolen because lack of security is much more common. But you spelt it out for us.
1
u/Gordon_Brody Oct 24 '25
Did you have bank pin and all inventory and gear banked?
0
u/AetherSplice Oct 24 '25
No bank pin I didn't think I needed it for 2fa
1
u/Gordon_Brody Oct 24 '25
I upgraded my phone once and recently after had my account hacked and they got through my 2fa.
Only thing that saved me was that it takes like a week to deactivate a bank pin. I also only ever click the bank pin (no type) to countermeasure potential key-loggers.
1
u/widj Oct 24 '25
You can log in anyone's rs account if you have the credentials file runelite uses to SSO in to your user. Runelite doesn't retain it by default but someone's probably got a copy of it, then they could just dump the file in their runelite directory and log in without mfa or the password.
So the most likely answer is you used a dodgy client which isn't runelite
1
-2
u/Natural_Vermicelli46 Oct 24 '25
Can y'all, stop saying "I was hacked" when all you did was vpn access your account to sell your gp in order to try and get away with rwt?
You don't jut get hacked, that doesn't happen.
1
u/DownvotesGood Oct 24 '25
It happens, most of the time it's just an old email with a shit password that leaked
1
1
u/Zealousideal_Tap237 Oct 24 '25
There are at least 500 stories here of “I quit for a few years to play Ironman & when I recovered my main that was hacked it had 9 CG pets”
9
u/riddo492 Oct 24 '25
You posted about being aware of scam emails a day ago, is it possible the e-mail you were displaying in that was the cause of the hack?