I have read the answer below and understand that there is not much I can do about the basic problem of somebody signing up for newsletters and online services using my email address:
Someone used my email address in order to access an online account
However, my question is more nuanced. Here's the story...
About one month ago, somebody started signing up for crypto/trading sites using my gmail address. They keep using the same name and assuming it is actually their name, the person appears to be a 27 year old male from Seaford, Delaware and has had a few minor convictions for possession of marijuana and minor traffic offences (if one can believe the free background checking sites). I am based in Sydney, Australia.
So far this person has signed up for:
- Coinigy
- Coinone
- Robinhood
- Stash
- Marketminer
- Tradecoins
- Plus a few other newsletters and investment dashboards.
They have even transferred funds ($10 and $25) to a couple of the sites and made some small investments in ETFs.
Some of these sites require email address verification, so I don't click on the verification links for those sites, thereby limiting the problem. Somewhat surprisingly though, many of these sites do not require email address verification, so for these sites I have been logging in and changing the password.
The "attacker" (I use the term loosely, because I'm not 100% sure what is actually going on here) has not been able to access my gmail account, as it has a super-strong password (which I have recently changed, just for good measure), 2FA using Google Authenticator, plus I have been checking the access logs regularly and have seen no logins other than my own IP addresses. Nobody else has the password to the two computers I use to access my gmail account and I have scanned both of them with two different anti-virus products to ensure that I haven't been hacked. I have checked on https://haveibeenpwned.com and the address wasn't listed.
The email address itself a fairly obscure, non-obvious, non-dictionary word. It wasn't cool 10 years ago but since the rise of crypto trading it might now be considered cool by some. I do use the address as my contact email on my domain name registrations, so this could be where they found it.
I am trying to determine if this individual is:
Completely ignorant of what they are doing.
Deliberately using an email address that isn't theirs for some obscure reason that isn't nefarious.
Deliberately using an email address that isn't theirs because they are attempting some kind of illegal activity.
I realise this isn't a simple question with a single right answer, but if someone can provide a very compelling theory as to what might be going on and/or some strategy I should take to deal with the problem, I will happily accept that answer. I am mostly interested in the "why would they do this?" aspect though.
