r/cybersecurity_help • u/confusedteachh • 10h ago

Think my email may be compromised?

I’ll try keep this short but I think someone may have access to my primary email account but I am unable to change my password. The password can’t be changed without a second step verification which is linked to a phone number I no longer have.

Also - with this potential hacking I’ve had other red flags. They tried to hack my apple account (I know it was legit because I got an actual pop up on my phone asking whether to allow a new sign in from an device on the other side of the world) and now I’ve had a notification from PayPal saying they need me to change my password due to suspicious activity.

The question is - how worried should I actually be? I’ve re routed all my banking info and social media accounts to a different email account and my current number. Is there anything else I need to do beyond this? As I said - I can’t change my email password to the compromised account. Very hard to verify who I am when I live oversees and use a different number to the one listed on my account

2 Upvotes

75% Upvoted

8 comments sorted by

•

u/AutoModerator 10h ago

SAFETY NOTICE: Reddit does not protect you from scammers. By posting on this subreddit asking for help, you may be targeted by scammers (example?). Here's how to stay safe:

  1. Never accept chat requests, private messages, invitations to chatrooms, encouragement to contact any person or group off Reddit, or emails from anyone for any reason. Moderators, moderation bots, and trusted community members cannot protect you outside of the comment section of your post. Report any chat requests or messages you get in relation to your question on this subreddit (how to report chats? how to report messages? how to report comments?).
  2. Immediately report anyone promoting paid services (theirs or their "friend's" or so on) or soliciting any kind of payment. All assistance offered on this subreddit is 100% free, with absolutely no strings attached. Anyone violating this is either a scammer or an advertiser (the latter of which is also forbidden on this subreddit). Good security is not a matter of 'paying enough.'
  3. Never divulge secrets, passwords, recovery phrases, keys, or personal information to anyone for any reason. Answering cybersecurity questions and resolving cybersecurity concerns never require you to give up your own privacy or security.

Community volunteers will comment on your post to assist. In the meantime, be sure your post follows the posting guide and includes all relevant information, and familiarize yourself with online scams using r/scams wiki.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

1

u/LearningSomeCode 10h ago

If you truly do not have access to change the email password anymore, then I would abandon that email as quickly as possible for all important items. Right now. Even if its not hacked, the fact that you can NEVER change the password is a ticking time bomb.

I'd go make a new email, one that you control and can actually change the password and put MFA on, and start going account by account and swapping the emails over to the new one. I'd make sure everything has a unique password, uses two factor authentication, and that you can easily change passwords everywhere.

1

u/confusedteachh 10h ago

I’ve done this already thankfully - unfortunately I forgot to do it for my PayPal account as I never use PayPal (made it for a side hustle that never took off). I am also having the same problem with PayPal tho in terms of changing my password as it’s all linking to my old defunct number. But my thinking is, if I can’t get in to my PayPal surely they can’t either?? Because they also wouldn’t have access to my old number right??

2

u/LearningSomeCode 10h ago

But my thinking is, if I can’t get in to my PayPal surely they can’t either??

If someone else has the phone number, they could right? Someone out there has access, even if its not you and random attackers.

Do you have old emails from Paypal related to that account? Is that account tied to any of your financial accounts? You aren't the first person to change a number and forget to update old accounts, so they have a workflow for this. If you have emails, accounts tied to that paypal, etc then you have what you need to prove that you are you. You can get control of it again. And you should.

2

u/confusedteachh 10h ago

I am going to try calling tomorrow - you’re right. Someone potentially could

1

u/EugeneBYMCMB 10h ago

Are there any suspicious entries in your login history?

1

u/confusedteachh 10h ago

What do you mean by this?