stereocourier

Q: iTunes store account hacked

I'm posting this just to share my story and get reactions. It's a little detailed but I thought worth sharing.

On November 23, 2010 I purchased a single song from the iTunes store for .99. I used store credit that I had from a gift card I received last year. It was the first purchase I had made since July 2010.

On November 25, 2010 I received a receipt for 2 more separate orders to my account. These were for over $50 in iPhones apps. Here's a sampling of some of the purchases:

1 eREAD isoshu, v1.5, Seller: ChengDu YueTong Internet Information Co. Ltd (17+)
2 Plants vs. Zombies, v1.3, Seller: PopCap Games, Inc. (iDP)
3 Monkey Island 2 Special Edition: LeChuck's Revenge, v1.1, Seller: Lucasfilm International Services Inc.
4 Asphalt 5, v1.2.6, Seller: Gameloft (9+)
5 Let's Golf!® 2, v1.0.1, Seller: Gameloft (4+)
6 Frames & FX for Photos, v2.5.1, Seller: Imikimi, LLC (12+)
7 Stenches: A Zombie Tale of Trenches, v1.0.1, Seller: Thunder Game Works (9+)

I do not have a credit card linked to my account, so these were made using my store credit.

I have only 1 computer authorized for my account (my personal home computer). I live alone and no one else touches my Powerbook but me. I also DO NOT own an iPhone, so I would have no interest in apps.

After I saw these bizarre purchases, I checked my account. I noticed 2 strange things: My account information had changed: My street address was correct, but city, state and zip had changed to: Towson, MD 21286-7840. I have never lived in Maryland. Also, I noticed that my password recovery answer had changed to "Murray" in response to a question about my mother's maiden name. That's decidedly NOT my mother's maiden name. Also, my birthdate had changed to an incorrect month and day.

I immediately changed my password and my recovery question/answer challenge.

I reported problems on all of these purchases and also contacted iTunes Account Support by e-mail.

Within 24 hours I received an e-mail from "Vicki" at iTunes Customer Support. She wrote:

"When reviewing over your account "name@domain.net" and the two reported orders, it shows that the content purchased within them was acquired from the computer that is currently authorized for your iTunes account. So I strongly advise that you do consult with those in your household regarding the purchases made, and the charges that resulted from those purchases."

Further:

"I have gone and reversed the charges for the two orders....You will see a store credit in three to five business days....Please note that this is a one-time exception, as the iTunes Store Terms and Conditions state that all sales are final."

I am pleased that Apple is refunding my store credit and replied so quickly.

However, it is simply impossible that these purchases were made from my computer. Again, my Powerbook is the only computer I have ever authorized to access my account, and I am the only person with access to it.

I am not sure how this happened. Any thoughts or similar experiences?

Powerbook G4, Mac OS X (10.5.8)

Posted on Nov 28, 2010 3:45 PM

Close

Q: iTunes store account hacked

  • All replies
  • Helpful answers

first Previous Page 90 of 131 last Next
  • by assassin9110,

    assassin9110 assassin9110 Mar 8, 2012 6:48 AM in response to stereocourier
    Level 1 (0 points)
    Mar 8, 2012 6:48 AM in response to stereocourier

    umm there is a way to remove the gift card for a while and put it back on? probably not eh?

  • by the usernamekatyisalready taken,

    the usernamekatyisalready taken the usernamekatyisalready taken Mar 8, 2012 6:49 AM in response to assassin9110
    Level 1 (0 points)
    Mar 8, 2012 6:49 AM in response to assassin9110

    I wouldn't have thought so...

  • by MadScientistZ,

    MadScientistZ MadScientistZ Mar 8, 2012 8:57 AM in response to stereocourier
    Level 1 (0 points)
    Mar 8, 2012 8:57 AM in response to stereocourier

    I am officially done with Apple and iTunes.

     

    Furthermore, I will advise each of my clients to never trust Apple or their iCloud with any sensitive data.

     

    Apple clearly has a major security breach and is either in denial or is purposely covering it up to maximize profit. Either way, I'm done with Apple. Apple cannot be trusted.

  • by caebrasil br,

    caebrasil br caebrasil br Mar 8, 2012 9:00 AM in response to YUKON_HO
    Level 1 (0 points)
    Mar 8, 2012 9:00 AM in response to YUKON_HO

    Yeah, it's seems to be a problem with In-app security, focused on games.

  • by the usernamekatyisalready taken,

    the usernamekatyisalready taken the usernamekatyisalready taken Mar 8, 2012 9:24 AM in response to aircool
    Level 1 (0 points)
    Mar 8, 2012 9:24 AM in response to aircool

    Looks like the thought police have been deleting your posts again!

     

    At least we know "they" have been reading our posts I guess....

  • by jake2034,

    jake2034 jake2034 Mar 8, 2012 9:39 AM in response to PatrickGSR94
    Level 1 (0 points)
    Mar 8, 2012 9:39 AM in response to PatrickGSR94

    PatrickGSR94 wrote:

     

    Just noticed that iTunes 10.6 is out, wonder if there have been any changes to help combat this widespread issue?

     

    On another note, iTunes Terms and Conditions were updated in the last 24 hours.  I know this part below didn't change, but I just happened to read it this morning:

     

     

    iTunes Terms and Conditions

     

    As a registered user of the iTunes Service, you may establish an account ("Account"). Don’t reveal your Account information to anyone else. You are solely responsible for maintaining the confidentiality and security of your Account and for all activities that occur on or through your Account, and you agree to immediately notify Apple of any security breach of your Account. Apple shall not be responsible for any losses arising out of the unauthorized use of your Account.

     

    Emphasis mine.  Really makes you feel great about Apple doesn't it? /sarcasm

    It's amazing how they assume it'll always be our fault. Like noone will get into Apple's database and steal account e-mails and passwords. No, no, you're right Apple, you'd never get hacked. Nobody will beat you!

     

    Apple really needs to get off of their high horse and actually care about their customers. It ***** when you love a company's product, but realize how rotton they can be when you need their help.

  • by aircool,

    aircool aircool Mar 8, 2012 9:43 AM in response to MadScientistZ
    Level 1 (0 points)
    Mar 8, 2012 9:43 AM in response to MadScientistZ

    Seconded.

  • by PatrickGSR94,

    PatrickGSR94 PatrickGSR94 Mar 8, 2012 9:45 AM in response to the usernamekatyisalready taken
    Level 1 (2 points)
    Mar 8, 2012 9:45 AM in response to the usernamekatyisalready taken

    aircool wrote:

     

    Apple "catch-all" statement,

     

    Interestingly enough I have just been informed by Apple that my previous post has been removed see below:

     

    Apple removed your post titled, "Re: iTunes store account hacked," because it contained the following:

     

     

    Rude or inappropriate language

    Non-constructive rants or complaints

     

    Isn't it such a shame that they are not on the ball when it comes to theft and fraud perpetrated through their system.

     

    I think that after being ripped off and patronised by standard lip-service replies I am entitled to my opinion.

     

    Wonder how long this will stay...

  • by mfromnc,

    mfromnc mfromnc Mar 8, 2012 9:50 AM in response to stereocourier
    Level 1 (0 points)
    Mar 8, 2012 9:50 AM in response to stereocourier

    Yeah. This morning I was hacked for $74 from my account. All for in-app purchases for some stupid WoW rip-off called "Kingdoms of War".

  • by the usernamekatyisalready taken,

    the usernamekatyisalready taken the usernamekatyisalready taken Mar 8, 2012 9:52 AM in response to mfromnc
    Level 1 (0 points)
    Mar 8, 2012 9:52 AM in response to mfromnc

    I get the general impression, our accounts simply aren't safe - through no fault of our own

  • by Robbo7080,

    Robbo7080 Robbo7080 Mar 8, 2012 10:28 AM in response to stereocourier
    Level 1 (0 points)
    Mar 8, 2012 10:28 AM in response to stereocourier

    I woke up this morning to find my £25 voucher chipped away to a measely £3.66.

     

    文明复 from Hangzhou MR.GLEE Tech. co., Ltd and associated in-app purchases was my 'download'.

     

    How Apple can have the gall to rid themselves of responsibility of unauthorised account use is beyond me!  Just as well they don't have my credit card details - doing a quick google I found stories of people being hundreds of dollars out of pocket

  • by libbyfrommurfreesboro,

    libbyfrommurfreesboro libbyfrommurfreesboro Mar 8, 2012 12:06 PM in response to stereocourier
    Level 1 (0 points)
    Mar 8, 2012 12:06 PM in response to stereocourier

    The last several posts have mentioned thinking there may be a connection with gift cards.  Maybe it increases your risk or something, but I had no gift cards...never have.  Yes, I purchase apps fairly often, usually FREE ones.  I've now been hit for about $40 through PayPal.  If it isn't safe to use iTunes, how am I supposed to make the most of my iPhone?

     

    I spent about 30-45 minutes this morning dancing in circles with Apple's website.  I just wanted to know where else I should check for fraud.  Bank account looks fine.  Is all the info on my phone in someone else's hands?  I don't know that I have anything valuable there, but it feels creepy.

     

    For those of you better at piecing this problem together, here's a little extra info.  Yesterday, I received an email completely in Chinese.  I laughed it off as the ultimate in junk mail.  Just after I had gone to sleep, my phone woke me up with a message on the screen about allowing apps to be loaded automatically.  In my sleepy stupor, it sounded like convenience thing.  I hit okay and went back to sleep.  Had I been awake, I think I would have looked into better.  This morning I awoke to these iTunes app purchases.  The first ones were free followed by an in-app purchase.  I haven't looked closely at the rest.

     

    I've already changed all passwords and security questions for AppleID and PayPal, and I've submitted the disputes for the two transactions on PayPal.  Is there more I should do?

  • by geoffers1,

    geoffers1 geoffers1 Mar 8, 2012 12:20 PM in response to stereocourier
    Level 1 (0 points)
    Mar 8, 2012 12:20 PM in response to stereocourier

    This happened to me today.

     

    Got an email saying an device not authorised has purchased an app, KingdomConquest. Total ripped out of my account (which was added 1 week ago via a gift card) £16.96.

     

    Having a mare trying to get through to Apple support, finally got an email back saying the purchase was made on my iPad.

     

    That snippet of info doesn't fit in with the email about it being from an unauthorised device.

     

    Currently Apple are saying it must be me, or someone with access to my iPad.  The purchase was made at 2 minutes past midnight this morning.

     

    I was asleep in bed, my wife was asleep in bed, our kids have left home.  That only leaves the dog - he's sleeping in the garden tonight to make sure he doesn't play with my iPad again!!

     

    Seriously though, how do you get Apple to give you your money back? And how to I see what devices are autorised on my account? I've tried "deauthorising all" but it says you can only do this once per year and I need to wait until April 2012 to do it again.

     

    Love Apple products, but their security is a cause for concern.

  • by PatrickGSR94,

    PatrickGSR94 PatrickGSR94 Mar 8, 2012 12:33 PM in response to geoffers1
    Level 1 (2 points)
    Mar 8, 2012 12:33 PM in response to geoffers1

    The "Deauthorize All" function refers to COMPUTERS authorized to play purchased music and movies.  You can have up to 5 authorized computers.  A single account can have up to 10 authorized devices, 5 of which can be computers.  To play purchased content in iTunes on a computer, you first have to authorize it.  Deauthorize All removes that authorization from any computers that have been authorized by your account.

     

    Unfortunately there is no such authorization associated with phones or other mobile devices.  If someone has your ID and password, they can purchase, download, and play purchased content from your account on that device.  And as such, there is also no way to deauthorize such mobile devices.  Your only recourse is to change your account password and security question.

first Previous Page 90 of 131 last Next