Macy's account hacked, and I can't do anything about it [update: I did something about it]

Drez

So I got an email about 40 minutes ago saying the following:

We’re confirming you changed your Macy’s email address to: <an email address that isn't mine>.

If you didn't make this change, please call Customer Service immediately at 1-800-289-6229. We’re available 24 hours a day, 7 days a week.

Have a question? Contact Us

I confirmed that the email is legit. I also tried logging in using my email and password, it didn't work. So definitely hacked.

So I did just that: Called immediately. I went through their automated system, first going to the Credit Card account portion of the menu and selected the option to speak to an agent. No luck, no Credit Card agents are available until the morning.

I called back and got one of the 24/7 sales reps on the line. They told me that the Credit Card account people were not available until 9:30 in the morning. I explained the content of the email and my security concerns. They said that no one was available. I said that this is unacceptable. They said they would put me in touch with an account rep. They put me on hold for 20 minutes and then hung up on me.

I called back a third time, and this time went to check my balance. My available balance is definitely about $120 lower than it should be, but my recent transactions don't reveal anything. I'm assuming this is because they don't list pending transactions. I then tried to go to the lost/stolen credit card area of the menu. Guess what? No agent there either. It takes you to a recording that says "if your Macy's AMEX credit card is lost or stolen, please leave the full number of your card and your information. BEEP." So you have to leave a recording. And I don't have a "Macy's AMEX" card, nor do I really feel comfortable just reciting this information into an answering machine and hoping for the best.

I don't see any way to recover my account. I've scoured the Macy's site and nothing.

So basically, someone is ordering shit in my account RIGHT NOW and I can't do anything about it.

Any thoughts here? Do I just give up until 9:30 in the morning? I'm really pissed, but I guess I've done all I can do and I can't be held liable for this just because Macy's customer service is a bunch of garbage, right?

Drez

OK so this idiot didn't change my password. I was able to get into my account online using the fake email address Macy's put in the email I got.

First thing I did was change my email address back to my real email address AND changed my password to something unique.

Second thing I did was check my recent orders. Guy tried to order a $130 fitbit using my Macy's credit card. I canceled the order.

This guy put full address and phone number information into the order. Anything I could or should do with that on the chance that it's not a dummy address?

edit: Also, I assume I should still give Macy's a call in the morning to discuss this?

dispatch.o

Drez wrote: »

OK so this idiot didn't change my password. I was able to get into my account online using the fake email address Macy's put in the email I got.

First thing I did was change my email address back to my real email address AND changed my password to something unique.

Second thing I did was check my recent orders. Guy tried to order a $130 fitbit using my Macy's credit card. I canceled the order.

This guy put full address and phone number information into the order. Anything I could or should do with that on the chance that it's not a dummy address?

edit: Also, I assume I should still give Macy's a call in the morning to discuss this?

I'd probably go ahead and change all your passwords, unless you know for sure the route they took to get your information.

When you contact Macy's in the morning, they should have an entire department set up to walk you through filing a report with the appropriate agencies.

Drez

dispatch.o wrote: »

Drez wrote: »

OK so this idiot didn't change my password. I was able to get into my account online using the fake email address Macy's put in the email I got.

First thing I did was change my email address back to my real email address AND changed my password to something unique.

Second thing I did was check my recent orders. Guy tried to order a $130 fitbit using my Macy's credit card. I canceled the order.

This guy put full address and phone number information into the order. Anything I could or should do with that on the chance that it's not a dummy address?

edit: Also, I assume I should still give Macy's a call in the morning to discuss this?

I'd probably go ahead and change all your passwords, unless you know for sure the route they took to get your information.

I don't, sadly, and I am thinking I will do just that. Luckily, my Macy's password wasn't used at many other places.

ceres

When you change whatever passwords you're going to change, make sure you do it from a device you know for 100% suresies is clean.

I'm just going to go ahead and assume you were smart enough to go to the Macy's site directly rather than click a link in the email, and that once you did that you used the number that appeared on that site to call in and not a number listed in the email.

I just went through this recently on a different site, fortunately I thought to do all these things so I didn't need to pay for 100 more 5-lb gummy worms or super-shitty headsets, because I'm pretty sure my account was obtained by a fucking 12-year-old. I ended up nuking from orbit because the only account less convenient to lose access to would have been with my bank, and I'm not willing to go through that.

It probably sounds paranoid but... be paranoid.

ceres

I mean seriously, $35 for a shiny-but-trashy headset with godawful reviews.

And I'm still getting emails from this other company asking me to tell them how great their gummy worm is.

edit: I mean, not that I'm still mad or anything.

ArbitraryDescriptor

When you change whatever passwords you're going to change, make sure you do it from a device you know for 100% suresies is clean.

Definitely this. If they pulled it off a keylogger, for example, then they have the new one too.

And definitely still yell at Macy's in the morning. I think they'll be the ones to handle informing the authorities too.

But if they don't have a means to report a stolen card when it's dark outside, who the hell knows.

Fiendishrabbit

Report it to the police as attempted fraud.
You have a telephone number and a delivery adress that should least be enough for the police to send a unit there and give the scammer a good scare (if it's in the same country).

It would have been best if you had taken screenshots before you changed email/password/deleted order.

Do yell at Macy's for not taking their online security seriously enough. There should be procedures in place for immideate shutdown of an account.

bowen

Start using a password manager too.

zepherin

Also call the credit agencies and put a fraud watch on your credit. You don't know how much of your info they have.

mittens

Macy's partnered up with American Express a couple of years back to provide lines of credit so that's why they mentioned the Amex piece in the phone message. But because Macy's is such a shitty operation (I also had a Macy's/Amex card that was only used when shopping at Macys and Costco when it was Amex-only) you don't get any of the great customer service American Express provides. The only reason I got the card in the first place was when my wife and I were building a wedding registry there and we got a ton of discounts for doing so. When Costco finally switched over to using Visa I canceled that awful Macy's card the next day.