29

I got an Email (to my iCloud address) from Disney+. The email contained a subscriber agreement. I did not register for their service myself. On the Disney+ website I saw that there was indeed an account for my email address. Using "forget password" I was able to log into the account and change the password.

I contacted Disney support, asking them to delete the account. However, they said that they can not delete the account since there is a running subscription via iCloud. This subscription has to be cancelled in order for the account to be deleted.

At this point I was very concerned that someone has hacked into my iCloud (which runs under email address used for the Disney+ account). So I logged into my iCloud and checked the running subscriptions and active devices but there was no suspicious activity at all and no Disney+ subscription listed.

My questions are:

  • is it technically possible that the Disney+ Account is connected to my email-address but using a different (unknown) iCloud account for the subscription?
  • are there any security concerns for me or have I just randomly be given a free Disney+ account (by someone else's mistake)?
Improve this question
12
  • 1
    I have a very common name. It's surprising how many people looking for a bogus email address hit on mine. I do the same thing you've done, namely change the passwords. I've also canceled hotel and airline reservations. After all, if there were problems, the hotel, airline, etc. would presumably think the problems were my fault.
    – Bob Brown
    Jul 23, 2022 at 20:19
  • 9
    I had the same thing. In my case it blocked me signing up for Disney Plus myself as the email address was already in use. I had the same conversation with customer service who refused to do anything. I logged in and changed the password but was unable to close the account using it (or just change the email address to some other address than mine) as I didn't know their PIN. They badly need to validate ownership of email addresses!
    – Martin Smith
    Jul 24, 2022 at 0:25
  • 15
    Taking over an account that does not belong to you can have legal and criminal implications in some jurisdictions. Just because you control the email does not mean you have permissions to someone else's account on another service.
    – schroeder ♦
    Jul 24, 2022 at 7:48
  • 2
    "I was able to log into the account and change the password" can be a big security issue if you use the same email/password combination elsewhere, especially if you didn't make 100% sure you logged in to the real Disney site.
    – Guntram Blohm
    Jul 24, 2022 at 9:18
  • 3
    @GuntramBlohm - just to be clear the mechanism presumably used was to use the "forgot password" facility to get an emailed link to reset the password. So the original credentials aren't ones reused elsewhere. Of course then standard advice about not reusing passwords should apply.
    – Martin Smith
    Jul 24, 2022 at 9:33

3 Answers 3

Reset to default
28

Yes, it's possible to use your email address and pay via credit card, PayPal, subscription cards or the respective mobile providers (Apple / Google Pay). It does not have to be a payment with Apple Pay / your iCloud account. As you are able to login, you should see the used payment method in the account's "billing details".

I do not see any further security concerns on your side. You already checked for an intrusion into your iCloud account and there seems to be none, which is good. You contacted Disney and they did not care (which is questionable). I'd say whoever created this account is going to realize he is no longer able to login and therefore going to cancel the payment subscription sooner or later. Lesson learned for the person who created the account with a random email address.

You probably get a notification email after the subscription has ended, then you are able to delete the account.

Improve this answer
9
  • 27
    I'm very surprised that Disney is apparently willing to charge a subscription for an account with an unverified (presumably) email address. That strikes me as an obvious no-no.
    – Kevin
    Jul 24, 2022 at 3:15
  • 3
    What would someone have to gain by creating an account in someone else's name in the first place?
    – stevec
    Jul 24, 2022 at 5:30
  • 23
    @stevec Speculation: they're using a stolen/hacked credit-card etc. to pay for the service and don't want it tracked back to their email address.
    – TripeHound
    Jul 24, 2022 at 7:26
  • 33
    @stevec I get this all the time - if you have a good email address, then the peeps who get xyz9@… often mistype and put xyz@… instead. I have [email protected] and get all sorts of interesting non-spam emails intended for other people, including legal documents, divorce proceedings, school documents etc. My Netflix account, for example, wasnt originally setup by me - twas an American who set it up 15 years ago, and I cancelled it a week or so later after changing the password (which triggered a lot of password reset attempts…)
    – Moo
    Jul 24, 2022 at 9:08
  • 4
    @Moo my dad had some older guy using his email address for ebay. Eventually he logged into the guys account, found his phone number and told him to change the email address associated with the account, or he would close the guy's open bids and delete the account himself
    – Esther
    Jul 25, 2022 at 14:35
8

While it is possible someone else created the account and paid for it, it's pretty unlikely.

It's more likely it's actually your account. Did you recently get a new phone or phone contract? Verizon, and probably others, offer temporary free Disney+ accounts and often automatically set them up.

Log back into the account and examine the billing information carefully to see how it's paid. Be doubly careful with PayPal as vendors commonly default the initial payment as recurring, allowing them to bill you for subsequent payments without notification.

In the end, the only risk to you is billing. Find out how it's billed.

Improve this answer
7
  • 11
    Why do you think "It's pretty unlikely"? It also happened to me and another answerer to this question. Disney apparently don't do any basic validation that the email addresses entered actually belong to the person signing up (e.g. to catch typos or just deliberately bogus addresses)
    – Martin Smith
    Jul 24, 2022 at 0:17
  • 1
    I get emails fairly often welcoming me to services I never signed up for, and I always go to the service, log in via "forgot my password", change the password to something completely random, ensure no purchases were made that I would care about, and, if possible, terminate the account. Just yesterday I got such an email from Zoosk where someone had created a profile with my email claiming to be a 70-something-year-old from Wisconsin (and apparently tried to use a prohibited profile image). Someone using OP's email to create a Disney+ account is way more likely than you might think.
    – Abion47
    Jul 24, 2022 at 2:08
  • 5
    The key reason is, "and paid for it". Anyone who spent money has a vested interest in resolving the error quickly. Unpaid bogus account creation attempts are common and not at all the same thing.
    – user10216038
    Jul 24, 2022 at 2:51
  • 7
    @user10216038 Not if they spent someone else's money using stolen/hacked credit-card details.
    – TripeHound
    Jul 24, 2022 at 7:30
  • 3
    @user10216038 Thank you! I think it's unlikely that it's my account since it is setup in Mexican language (i am located in Switzerland)
    – Jan
    Jul 24, 2022 at 16:46
6

This has happened to me as well.

You have two options: completely ignore the situation or take over the account (by using "Reset password").

In both cases there's no risk or anything. Your email alone is not enough to charge you.

Improve this answer
15
  • 7
    Taking over an account that does not belong to you can bring legal and criminal implications in some jurisdictions. Access is not consent. And since this appears to have been performed from the iCloud account (as per the vendor's description) this is more than just a "someone used the wrong email address when they signed up". There appears to be more going on.
    – schroeder ♦
    Jul 24, 2022 at 7:47
  • 7
    Impersonating a different person is a crime in itself. You're looking at the law from a skewed perspective. Taking over something which rightfully belongs to you is totally permitted by the law. Using someone else's email address is not permitted.
    – Artem S. Tashkinov
    Jul 24, 2022 at 12:01
  • 9
    "Rightfully" is the whole matter in question. The Disney account does not belong to you just because someone used your email account when they signed up. The one who agreed to the ToS is the one who the account belongs to. Entering an email when signing up is not "using" someone's email address. Your perspective as a hint of "I can touch it, therefore it is mine" but laws and contracts don't back that up.
    – schroeder ♦
    Jul 24, 2022 at 13:15
  • 4
    @schroeder - has there ever been a case where someone supplied the wrong email address on an online service and the email owner reset their password and it ended up in court?
    – Martin Smith
    Jul 24, 2022 at 14:05
  • 4
    @MartinSmith meaningless strawman is meaningless. The context here is "taking over the account" not merely clicking the password reset link. And "end up in court" is also not what I said. As an example, taking over an account is in direct contravention of the UK Computer Misuse Act. It counts as "unauthorised access" to that account. And since the person knows that it is not their account, the act of "taking it over" is done with the intent to prevent the authorised person from accessing the account, which adds more office according to the CMA.
    – schroeder ♦
    Jul 24, 2022 at 14:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .