My email address is being used to enroll for online services. Should I be concerned?

Question

Just before Christmas I received the following message in one of my GMail accounts:

Sign-in attempt was blocked
********@gmail.com [redacted by me]

Someone just used your password to try to sign into your account. Google blocked them, but you should check what happened.

I signed into that account and looked at the activity (not by clicking the link in the message, of course) and indeed there was a sign in attempt blocked from the Philippines.

I gather this means that an attacker entered the correct user name and password for my account, but was likely blocked because they couldn't pass the MFA challenge. Or maybe Google's fraud detection is actually decent and it knows I've never been to the Philippines? Either way, I immediately changed the password and (as far as I know) the attacker didn't gain control of the account.

However, in the 2 weeks since then, I have received several email verification requests from various online services that I never signed up for -- Spotify, OKCupid, a Nissan dealership in Pennsylvania (that one's interesting), and a few others I've never heard of before. Someone out there is actively using my GMail address to enroll for these services.

The account in question is not my main account, and while the password on it was admittedly weak, it was also unique (I never used it on anything else). I changed it to a password that's much stronger now.

Should I be concerned about this?

Also, if the attacker didn't gain control of the account, why use it to enroll in all these services?

Answer 1

The use of your email to sign up for services might be a coincidence and not being done by the party who logged into your account. I get a dozen of these types of "mistakes" a week from around the world due to my fairly generic email account. So, this set of events might not relate to the person who logged in.

However, there are a couple of scenarios that I see if there is some kind of correlation between the two events:

Scenario 1: Innocent Intent

The logged-in party tried to log into what s/he thought was their account to get access to the email and, using your weak password (as you have admitted), got lucky enough to log in. They have kept on using the email to sign up for things thinking that it is truly theirs.

Along with the dozens of wrong emails I get, I also get quite a lot of "password reset" attempts. While some of those might be hackers trying to get in, the volume, and the fact that they come in bursts, suggests that these are people trying to get into what they think is their own accounts.

The risk in this scenario is very low since everyone involved has no ill intent and things were done by mistake. They might get frustrated that they have lost access to what they thought was theirs.

Scenario 2: Email Harvesting Bot

There are automated scripts out there that try to bruteforce all kinds of accounts for the purposes of selling access to those accounts. I run my own honeypots and I get these all the time. The pattern is that the bot tries to log in, then once login succeeds, it simply stops. Its job is only to register the correct credentials. It is then exposed or sold off to those wanting to use it. In my experience, I see the successful automated brute force which suddenly stops, then days later, I get people logging in from around the world and running malicious scripts by hand. (I do presentations where I show how the hackers work command by command once they gain access. Sometimes it gets quite hilarious.)

With your weak password, one of these bots could have discovered the correct credential, stopped, registered it in a database, then moved on. It might not even know that Google blocked it from going further. Now people are using your email from that database as a known "hacked account" to sign up for services, not knowing that the bot's activity was discovered and you changed the password.

Why seemingly random services? To bypass bans on their main accounts, to launch forum bots, spam bots, reputation or like bots, or a whole host of automated unkindnesses.

The risk here is that your email is now well-known to malicious actors who know about it because they want to exploit it. After a while, they should stop using your email and move on to another of the thousands available. But you are now on a list.

Concern

Should you be concerned? Yes. But only so far as the need to strengthen your password (longer password, 2FA, more monitoring, etc.). It looks like your risks and threats are limited and you have responded appropriately.

Answer 2

Should I be concerned about this?

Yes.

This should be of concern to you because an attacker was able to obtain the valid password for your Gmail account. From the details of warning you have provided, it looks like it is from fraud detection rather than an OTP failure. If it was an OTP failure, you would have received an OTP when that login attempt was made (unless your OTP delivery mechanism is not email or SMS based).

You should explore the possibility that your password may have leaked. Do a search on HaveIBeenPwned to see if any of the websites where you have used that email were compromised. It is likely that you may have used the same password for signing up to a trivial service and forgot all about it.

The the intention of attacker was not to use your email to enroll these services, rather it looks like an attempt to verify if you are a user of any of those services. Most sign up options would ask you to login instead of sign up if you have an existing account with them. From the looks of it, the attacker wanted to identify the services you are already enrolled to with that email and wanted to try the same password on them.

To sum it up again, yes you should be concerned. You should explore why you are being targeted in the first place and how that initial password compromise may have happened.

Answer 3

You shouldn't be concerned.

Just as you said yourself, the attacker was blocked and you have changed the password. There are, however, some actions you should take:

1. Verify that the discovered password does not hint at any other password you may have used anywhere else.
2. Harden passwords of other accounts you hold that the attacker may deduce from the attacked address.
3. Try the 'reset password' feature on those sites where the attacker enrolled you. This way you can verify that they in fact did not gain access to your email (by verifying they did not finish the sign up process).

As to your last question, this is a long-shot but it might be an automated system that found out your password and the attacker failed to notice the multi factor authentication(?).

Answer 4

As far as I am aware, MFA only protects your login to the GMail web mail service. If the attacker could successfully guess your password and you have IMAP client access enabled on your GMail account, he would still have had access to your emails up to the time where you changed the password. You should definitely review those access settings, check the trash and sent folders for anything that might have been left by the attacker, and decide further actions based on the findings.

Answer 5

I have been getting "thanks for signing up" emails. But this does not infer that they know my password. Only my email address. My password is random generated about 50 characters, and I have been using 2fa for years. I change it regularly. I just mark them spam and ignore them

Answer 6

Also, if the attacker didn't gain control of the account, why use it to enroll in all these services?

First of all, some of the spam you are getting might actually be phishing attempts to lure you into revealing your password.

Second reason, and maybe the most obvious: since all those sign-in attempts generate security notifications, the hacker obviously wants to 'drown' those notifications in a deluge of spam. Indeed you are more likely to dismiss the notifications as spam.