1

I was woken today at 05:15 by a phone call from my bank, notifying me that the PIN number is XXXX.
I did not ask to change my PIN number, and actually, have not accessed the bank account electronically in a while.

I then checked my email and noticed that my guru.com account was accessed, and is now locked due to failure to answer the security questions correctly. Needless to say, it wasn't me who tried to access the guru.com account.

This attempt was made at 02:41 from Dhaka, Bangladesh, from IP Address 123.108.246.44 (the ISP for this IP is GrameenPhone (widely abbreviated as GP, is the leading telecommunications service provider in Bangladesh)). I do not reside in Bangladesh.

Any suggestions how to proceed, besides the obvious changing of credentials?

4
  • Proceed with what, exactly? It's difficult to understand how to respond to these events without knowing what the process is to change your bank's PIN. Can anyone phone up, pretend to be you, and request it? Same for guru. You said that they were not able to log in, and the lockout is a support call to that site to unlock. As you have described it, I do not see that anything has yet to be compromised. Someone is using the public access everyone has to do these things.
    – schroeder
    Commented Apr 18, 2017 at 6:35
  • Nothing seems to be compromised, @schroeder. However, if there was a way to alert proper (closer to the culprit) authorities with the data I have, so they could take action, that would be super. If I could further investigate the identity of the attacker, that would be fine also.
    – boardrider
    Commented Apr 18, 2017 at 10:12
  • 2
    So, your question is "how do I proceed with notifying the correct authorities?"
    – schroeder
    Commented Apr 18, 2017 at 10:13
  • Not necessary just that, but - what can I do to eliminate/dissuade the culprit from pursuing their evil ways.
    – boardrider
    Commented Apr 18, 2017 at 12:00

2 Answers 2

3

The first step is to identify if the attackers even managed to gain access to any accounts, or were still trying to get in. Head over to Have I Been Pwned? and check if any of your accounts have been leaked in the past. If that's a 'yes' - check if you were reusing your passwords. If that's a 'yes' again, go reset them and ensure that you use unique passwords this time around.

Next - if the attackers were attempting to access your accounts (I'm assuming this is the case, since your account was locked due to bad answers to the security Qs), I'd not worry as much. Reset the account, and go through the reset questions to ensure that you haven't given away the answers to them on social media or to anyone else you know.

All of this is general security advice. It's applicable to every question regarding actions to be taken after a breach.

Finally, if you're feeling very paranoid, you could call your account while you look around for what may have provided the attackers with information - scan your PC, wipe it if you have to. Do the same for all devices that you enter credentials on. Have you logged in on any new devices? Someone else's device?

1
  • Thanks for the URL you gave: I'll try that. Also, my answer to @schroeder comment to the OP is relevant here.
    – boardrider
    Commented Apr 18, 2017 at 10:15
0

If you feel like your system might have been hacked... Change all of your passwords... Reinstall your OS. If your system was compromised, it helps to make sure you're not getting key logged..

If you feel like a site you frequently used might have been hacked... Change all your passwords...

In my opinion, sounds like they obtained your info from a compromised site or possibly a pastebin of a site that was hacked. Check your email @ https://haveibeenpwned.com/

Not the answer you're looking for? Browse other questions tagged .