I got a Google alert a week or so ago about suspicious activity on my account. I deactivated all devices and changed my Google password (which is what I use with Google's password manager) and went about my day.
Then yesterday my email was flooded with sign ups to just random websites and accounts. Locked down everything again. Changed passwords again and Google traced the suspicious activity to my desktop so I deactivated that and turned it off while I got everything squared away.
Today my bank flagged a transaction of someone trying to wire money from my account to a routing number 041215663. Researching that shows an account that is associated with the Cash app. I contacted the bank, everything is frozen and in place, and I'm going in tomorrow to move all my accounts to a new number.
So I'm guessing someone got access to my email and into my bank account and tried the transaction (moving $4,897.14) via some malware on my desktop.
I've changed my main Google password twice. Manually changed all passwords to important accounts. I'm moving the affected bank accounts to new numbers tomorrow.
Later on I'll drop my wifi and turn on and wipe the desktop.
Anything else I should be doing?
Posts
Honestly they should be frozen anyways unless you have a reason for people to be running credit checks...
They will likely insist that you open a new account transfer everything over and close the old one. But the scammers already got all they need too, and it was just the banks internal checks that kept you from getting screwed.
Yup, did that just this morning so everything is in a new account.
So this is everything I've done so far.
1. New Google password. Unlinked all of my devices, manually signed into each one except for the suspicious desktop which is going to get nuked (currently powered down).
2. New bank accounts, new passwords for both myself and my wife. Reviewed all transactions and looks like nothing was actually moved.
3. Went through and updated passwords on everything else - I use a password manager so no two passwords match, but I still updated passwords on all our important accounts.
4. Froze my credit with Equifax, Experian, and TransUnion.
If the guy got access to just my bank account we're good, if they got access to my e-mail I'm surprised they didn't try and do anything with my credit cards or whatever.
Anyone think of anything I may have missed?
Oh good idea, yeah Google flagged my desktop as suspicious, which hasn't been turned on since this happened and I'm going to format it too. It's been like a decade since I did that.
Glad you/your bank caught it. So annoying.
Likely you're now in the clear, but being really paranoid I would.
- Use a third party device you trust to be secure and then access my google account using a web browser, looking in the security settings you should be able to see which devices accessed the account and when. That should tell you something about when someone did access you data if that is what happened.
- Consider if possibly more devices may be compromised, like for example it could be a phone. If it was your PC then did that share a network with your other devices, if so the those devices can have been compromised so that when you changed passwords the new ones were picked up.
As I say likely you are in the clear, but if you're holding like the nuclear codes make sure the "football" is cleaned. If anything less than that pick the balance which seems right for you. Personally I have two bank accounts so two credit cards, one I use for stuff I really trust and deal with regularly and one I use when shopping abroad or for the first purchase in a shop I am new to (There is such a thing as fake shops on the internet). Also I keep my savings and such in a separate bank, it annoys the other bank but I like the idea of the extra layer of security from for example those accounts not being attached to credit cards and so.
I isolated the compromised desktop at the first sign of a problem by disabling it's wireless adapters. Then I deactivated the devices, changed the passwords, then reactivated my phone.
Today I am backing up my desktop and then nuking it.
I'm not going to do a whole separate set of accounts. I mean I've got a new bank account number and all new password generated passwords.
I actually had about $3,000 taken several years back from a stolen debit card we never received. (Stole it out the mail)- We switched to a P.O box after that and I don't resent the yearly fee.
Edit-We also added a fraud alert to the 3 credit agencies. It supposedly keep credit cards from being taken out in your name and I think it lasts a year.
Looked up Experian's but I think they all have them:
https://www.experian.com/fraud/center.html