0

Someone is trying to change my passwords to take over my Gmail account and PayPal accounts. I have two factor log in, so I know this is happening daily. I know because I keep getting my passcode verification text two or three times a day from google and PayPal to change my password. How do I find out who this is?

2
  • 4
    Change your password ASAP and report the incident to the support of both Google and Paypal.
    – elsadek
    May 4, 2022 at 22:36
  • You likely can't "find out who" it is. Just make sure your account it protected. I mean, if you think it is your wife or kids, just ask them. If you have no idea who it might be, then it is probably some rando in a non-extradition country, so what is the point of finding out who it is...
    – hft
    May 5, 2022 at 0:03

2 Answers 2

1

How do I find out who this is?

You likely will not be able to find out who it is. To do so, would likely involve significant digital forensic investigation as well as issuing subpoenas to Google and Paypal for relevant data. And in the end you might find out that it was just some rando in a non-extradition country...

Some steps you can take to further protect your account include:

  1. Change/update your password and make sure it a strong password (just let your browser password manager remember it for you);
  2. Change from text-based two-factor authentication (2FA) to use Google's Authenticator app for 2FA. The Authenticator app is safer than using text-based 2FA.
0

hft's answer is superb, I wished to elaborate slightly on why you shold never rely on SMS two-factor authentication for any important accounts.

Phone numbers or accounts can be hijacked or transferred; this has happened 'in the wild' to numerous people over the last few years. (https://theconversation.com/how-hackers-can-use-message-mirroring-apps-to-see-all-your-sms-texts-and-bypass-2fa-security-165817 , https://www.theverge.com/2017/9/18/16328172/sms-two-factor-authentication-hack-password-bitcoin, etc).

SMS should be regarded as insecure by design due to how relatively trivial it is for malicious actors to access and abuse the SS7 network.

I always use a TOTP (Time-based One Time Passcode) 2FA app like Authy or Google Authenticator, which algorithmically generate one-time codes offline and works independent of mobile networks.

Generate random passwords using https://www.random.org/passwords/ and make sure each one is globally unique. Make a note of them somewhere offline (in a small book), do not just save them to your hard drive as text files.

By doing this, if login attempts continue, and you continue to receive 2FA notices, this is an indication your passwords are possibly being locally compromised - make sure your devices are also clean of viruses and malware.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .