3

Context:

I got a call from a US phone number from a guy claiming he was from a dark web website (something .onion, I can't remember) and he was calling regarding my "fake passport application". I hung up (call duration: 20s), he called back and I told him I hadn't applied for any such thing and hung up again (call duration: 40s)

A minute later, my phone is flooding with SMS's regarding One Time Passwords from about 20+ different websites. 20+ SMSs within the 10 seconds. (These were all genuine companies, like Amazon and stuff)

My question is, Am I being attacked?

Is my identity being used to sign up on different websites or this is just spam? Can an attacker gain access to these OTPs? How do I know my calls/texts/location/network usage isn't being monitored? Is my sensitive information at risk?

Extra Info:

I use an iPhone (iOS 12 Beta). My outlook account was compromised one day before this happened. (easy password). I've changed the password now.

Paranoia: The person on call knew my name. The sources of the OTPs are genuine. I don't see the motive behind sending OTPs from tons of different websites unless they can access the OTPs. (possible iOS vulnerability that isn't documented yet?) I see 4 possible intentions:

  1. Using my identity as part of a fake passport/profile on the dark web.
  2. Using my identity on regular websites (Amazon, etc)
  3. Gaining sensitive information from my device.
  4. Elaborate Spam/prank
Improve this question

1 Answer 1

Reset to default
2

An easy way to check if they are somehow getting access to the OTPs (and therefore to your accounts) is to log into your account and theck the activity log. Most reputable services (GMail, Amazon, etc) should have some way to view a list of date/time/location of recent successful logins.

If any of those were not you, then you have a problem.

Are you sure they are triggering your account's OTPs (which would sound like they are trying to get in to your account and / or may have already gotten past the password page)? Rather than signing up your phone number on new accounts (which could be the beginning of harassment / extortion)? OTP SMS messages don't typically tell you which account / username triggered them, but are you getting any OTPs for sites on which you don't have an account?

It's hard to say for certain that your sensitive information isn't at risk (apart from whatever was accessed via your Outlook before you changed the password), but this smells more like a social engineering attack of some sort rather than a technical attack.

My condolences that you've been caught up in this.

Improve this answer
2
  • The OTPs were used to create new accounts. I got a few more calls now but I haven’t picked up. How do I know what they’re aim is? Is there anything I can do? (Also, Outlook doesn’t say whether or not they gained access to information. It just says “unusual activity” and sent a verification code to my phone the next time I wanted to log in)
    – Shayan
    Jul 14, 2018 at 6:05
  • @Shayan Unfortunately, finding out what their aim is, or what data they accessed is hard, and stopping anonymous online harassment is equally hard :( it would even be hard for a company with a full cyber security team. For whatever reason though, you are under attack, so follow good security practices, use strong passwords. Depending which country you're in, your government may have a system for reporting online scams / harassment so that their phone numbers and tactics go into a database of known scams.
    – Mike Ounsworth
    Jul 14, 2018 at 12:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .