topic Re: Hacked lineone email in Email

Hacked lineone email

paultrench — Tue, 10 Oct 2023 14:04:50 GMT

Can Ady please send me a personal email in order that i can recover my hacked lineone email. unfortunately i cannot do a password reset as the hackers have changed my recovery number and email.

I am the originator of this email address and can provide you with id info etc to verify for data protection

Re: Hacked lineone email

Gondola — Tue, 10 Oct 2023 14:58:36 GMT

Hi Paul

Welcome back. Your mum has been posting here to help you recover access.

I'll let TalkTalk know that the password recovery options have been changed by a hacker. A TalkTalk Support member will need to verify you as the registered email user and set up your password recovery alternate email address and mobile number (the Reset details) so you can send a password reset link or code to authenticate a password change.

Prepare for TalkTalk Support - include in the Community Profile (not in these public posts):

Account holder name, TalkTalk home 'phone number (if not Data Only broadband)

Alternative mobile contact number. Full address with postcode (in the Location box)

Scroll down to Private notes to add the email address needing recovery

Check and Save changes

Select here: Update your profile

A TalkTalk Support member will reply to this thread and then Community Private Message you to confirm your customer account details and or details related to the original registration of the email address. Also requested will be the alternate email address and mobile number for password recovery Reset details.

When verified the Reset details will be set up during a working week within 24 hours allowing you to set your own password via the Forgotten your password journey. Make sure the password is ultra-strong and unique to the mailbox. Check via the TalkTalk Mail sign in that you can access the mailbox.

For a compromised mailbox I'd always suggest scanning your email devices for viruses and malware before changing any password.

Use the new password to access via the TalkTalk Mail sign in check there's no Auto forward or Filter rule diverting your mail messages. Hackers set up or modify Filter rules to spy on your emails.

Select the Main settings menu cog icon  top right on the blue header
(Unmigrated mailboxes - use a triple line icon and if using a Mobile browser - use the desktop version)
Select All settings... or Settings from the top of the menu
Select Mail
(Unmigrated mailboxes - select the inward facing arrowhead by Mail (or Email) in the left side panel and select Filter rules)
Scroll down to Rules
If you see There is no rule defined then you need go no further.
Select the Chevron icon > to expand the Rules section and to delete a Filter rule including any Auto forward
select the X icon (Dustbin icon  ) to the right of the rule
The icon background will turn red
To confirm you really want to delete this Filter rule
Select the blue Delete button

Let us know if you need more guidance.

Re: Hacked lineone email

paultrench — Tue, 10 Oct 2023 17:09:10 GMT

Thanks Gondola very helpful

Re: Hacked lineone email

Ady-TalkTalk — Wed, 11 Oct 2023 06:55:01 GMT

Hi paultrench, I've sent you a personal message to obtain more information.

Ady

Re: Hacked lineone email

paultrench — Wed, 11 Oct 2023 11:08:03 GMT

Hi Ady

I've now responded to your message but tried to input some details in the my account link which i dont think exists anymore. I have also updated my profile as requested so please let me know if you need anything further

Re: Hacked lineone email

Ady-TalkTalk — Wed, 11 Oct 2023 12:08:16 GMT

Hi paultrench, thanks for responding to my message. Unfortunately some of the information doesn't match what we hold on system.

I've resent the message. This time you might be best to set up the telephone enquiry password.

Ady

Re: Hacked lineone email

paultrench — Wed, 11 Oct 2023 13:59:06 GMT

Sorry Ady but when i try to set up a telephone password it asks me to go to my account but i am an old customer and have no current account so i am confused as how to proceed, please advise

Re: Hacked lineone email

Ady-TalkTalk — Thu, 12 Oct 2023 06:26:26 GMT

Hi paultrench, I've sent you some alternate questions.

Ady

Re: Hacked lineone email

paultrench — Thu, 12 Oct 2023 09:34:37 GMT

Thanks Ady and have now responded to your message

Re: Hacked lineone email

Ady-TalkTalk — Fri, 13 Oct 2023 05:12:05 GMT

Thanks for providing the information. I've sent the request for the Password Reset Tool to be updated for you. It will complete within the next 24 hours. To check when its completed simply go to the Password Reset Tool intermittently until you see your correct information in there.

Ady

Re: Hacked lineone email

paultrench — Fri, 13 Oct 2023 19:13:22 GMT

Hi Ady

Thanks for the reset which i did this afternoon and followed the instructions to the letter but when i just tried logging in this evening to check all was ok the hacker had gained access again, changed the password and changed the reset details to what they had before. I have no idea how this was possible as i am using a different laptop to log in so completely bemused. Can you therefore please help me again and what can be done to stop the hacker Regards Paul

Re: Hacked lineone email

Gondola — Fri, 13 Oct 2023 19:37:23 GMT

Hi Paul

Ady will return next week. I gave you the advice to scan all your email devices to remove password capturing viruses, trojans and other malware before changing any password. Also to delete any Rules (Filter rules) spying on your mail messages by copying or diverting mail from your Inbox.

In addition, as soon as you get access to a newly migrated mailbox there is an additional Security option to forcibly sign out any unrecognised devices.

Via the main settings cog icon top right, select the All settings menu item, select Security and Sign out any unrecognised device or select Sign out all devices and confirm the sign out of all except the one you're currently using.

Re: Hacked lineone email

paultrench — Sat, 14 Oct 2023 09:30:37 GMT

Hi Gondola

I did the scan and there were no rules for email forwarding but did not know about the security option to sign out unrecognised devices.

If Ady could issue the password reset again i will sign out the hackers device if it is visible but do not understand how it was possible for him to gain access. Is there nothing TalkTalk can do at their end security wise to prevent it happening as he couldn't get access with my reset email and mobile number

Re: Hacked lineone email

Gondola — Sat, 14 Oct 2023 10:12:23 GMT

Hi Paul

If you successfully proved there was no virus or other malware capturing your password and the new password met security requirements and wasn't readily guessable then we have to assume that the hacker was actively signed in to the mailbox and happened to notice you had new password recovery Reset details. Unusual but not impossible.

But make sure there are no Rules defined at all as it's not just the standard Auto forward rule that can spy on your mail messages. Hackers set and change other filter rules to see what's happening.

The new security feature that allows users to see which devices are signed in to the mailbox is there to help you control access. In the case of unauthorised access to forcibly sign out that device so you can change the password to lock out that device permanently. It's also useful in troubleshooting when the system detects multiple sign ins from geographically distanced locations and therefore limits the sending of mail to guard against spam sending but does not at that point lock out the user(s).

Remember that the hacker knows your email address so the only thing protecting your mailbox is the uniqueness of the password and its strength.

Are you positive your password recovery email address isn't compromised? It might be worth setting up a new Gmail / Yahoo Mail / Outlook.com address for password recovery if you're at all unsure.

Re: Hacked lineone email

paultrench — Sat, 14 Oct 2023 11:00:04 GMT

Thanks Gondola, hopefully Ady can help me out again on Monday or Tuesday

Re: Hacked lineone email

paultrench — Sun, 15 Oct 2023 15:01:11 GMT

Hi Gondola

After giving this some further thought if the hacker was still logged in he would have seen the email notification from TalkTalk that my password had been changed which would have alerted him to check the reset which he could then change and do his own password reset. It is therefore very important to sign out all unrecognised devices after someone recovers their email after it has been hacked

Re: Hacked lineone email

Gondola — Sun, 15 Oct 2023 15:30:58 GMT

It is important to carry out all the security related actions I've mentioned.

Re: Hacked lineone email

Ady-TalkTalk — Mon, 16 Oct 2023 12:05:03 GMT

Hi paultrench, I've sent another private message.

Ady

Re: Hacked lineone email

paultrench — Tue, 17 Oct 2023 13:28:48 GMT

Hi Ady

I replied to your private message yesterday and would be grateful if you would arrange another password reset

Regards

Paul

Re: Hacked lineone email

Ady-TalkTalk — Wed, 18 Oct 2023 05:55:28 GMT

I've got no details from your answers showing on system. I've sent it again.

Ady