05-27-2010, 08:22 AM

Hi all

Recently, someone managed to get Apple to change my AppleID!!

This impacted the iTunes store, AppStore and my Apple Developer account.

They'd managed to change the email address associated with my account and it was just fortunate that I had a recent iTunes receipt in my inbox.

I only noticed the issue when I tried to update some apps on my iPhone and was told that my password was incorrect. I ended up at iForgot and when I put my email address in it said the there was no such AppleID!!

I've tried to get Apple's support to tell me how it was possible for someone to acheive this so that I could identify where the breach had occurred but they won't give any information without a subpoena. They suggested that I change the password for my email account which I thought was a bit bizarre as it wasn't my email account (AFAIK) that was compromised. They did quickly put my ID back to my email address but not before the individual had purchased an iTune using the debit card associated with my iTunes account. The loss is only 79p but it could have been much worse.

I've left my account disabled at the minute as I still don't know how someone managed to make this change so it could happen again.

Has anyone else had an issue like this?

Thanks

Bill

05-27-2010, 08:57 AM

I have read several reports of this happening recently. There's a discussion at the site below:

iTunes Store: Experiences

It seems like scammers are targeting these accounts in light of the popularity of iTunes and the iPhone/iPad.

Long story short:

• Use a strong password on your iTunes account.
• Use a strong password on the email account bound to your iTunes account
• Consider removing your credit card from your iTunes account.

If your iTunes account is bound to a debit card, I would definitely remove it. You may get your money back eventually, but in the meantime your bank account balance might be affected.

Also, if you use your MobileMe account as your iTunes account, be doubly sure that your password is strong, since you only have that one password guarding both your email and your account.

05-27-2010, 02:19 PM

This is why I don't like it when sites choose to store my credit card. I prefer to enter it in manually every time I make a purchase. Also the really good sites don't store anything at all because they don't force me to create an account. I get to choose to enter everything in myself when I make a new order.

Of course it makes it a little inconvenient but remember if something is convenient for us it's also convenient for the criminals. For sites that do store your credit card you can manually delete it after each purchase or better yet contact the website to allow you to enter it in manually every time.

You really shouldn't use your debit card either because that links directly to your bank account. With a credit card there is at least a delayed billing cycle before they can collect money from you. It gives you time to dispute any false purchase charges. Also follow technologist's advice about using strong passwords.

05-28-2010, 04:58 AM

Thanks for the responses and info guys.

My problem is that my password was strong (non-sequential, mixed case, alphanumeric, over 8 characters) so I don't know the source of the issue.

Its either Apple have been lax and have changed my ID as part of a emailed request which spoofed my email address. Alternatively, there's a key logger on one of my machines although I have up to date anti-virus and anti-spyware software running on all of them.

Without any info from Apple I don't know where to start tightening things up.

Cheers

Bill

05-31-2010, 03:29 PM

This just happened to me last month and I was using a 12 character password and I only use itunes for my phone. I lost 261.63 in total charges but this was refunded and I had to purge my old account with meant I lost all of my previous purchases which really suck since i spent over 100 in apps for my iphone. They refunded all my purchases though from the attacker so it was alright. I did have to create a new account though and i change my password every week so I can prevent it from happening again. So my best advice is to keep that password changing and use only itunes gift cards for purchases so they cant take any money from your CC or debit card.