stereocourier
Level 1 (0 points)

Q: iTunes store account hacked

I'm posting this just to share my story and get reactions. It's a little detailed but I thought worth sharing.

On November 23, 2010 I purchased a single song from the iTunes store for .99. I used store credit that I had from a gift card I received last year. It was the first purchase I had made since July 2010.

On November 25, 2010 I received a receipt for 2 more separate orders to my account. These were for over $50 in iPhones apps. Here's a sampling of some of the purchases:

1 eREAD isoshu, v1.5, Seller: ChengDu YueTong Internet Information Co. Ltd (17+)
2 Plants vs. Zombies, v1.3, Seller: PopCap Games, Inc. (iDP)
3 Monkey Island 2 Special Edition: LeChuck's Revenge, v1.1, Seller: Lucasfilm International Services Inc.
4 Asphalt 5, v1.2.6, Seller: Gameloft (9+)
5 Let's Golf!® 2, v1.0.1, Seller: Gameloft (4+)
6 Frames & FX for Photos, v2.5.1, Seller: Imikimi, LLC (12+)
7 Stenches: A Zombie Tale of Trenches, v1.0.1, Seller: Thunder Game Works (9+)

I do not have a credit card linked to my account, so these were made using my store credit.

I have only 1 computer authorized for my account (my personal home computer). I live alone and no one else touches my Powerbook but me. I also DO NOT own an iPhone, so I would have no interest in apps.

After I saw these bizarre purchases, I checked my account. I noticed 2 strange things: My account information had changed: My street address was correct, but city, state and zip had changed to: Towson, MD 21286-7840. I have never lived in Maryland. Also, I noticed that my password recovery answer had changed to "Murray" in response to a question about my mother's maiden name. That's decidedly NOT my mother's maiden name. Also, my birthdate had changed to an incorrect month and day.

I immediately changed my password and my recovery question/answer challenge.

I reported problems on all of these purchases and also contacted iTunes Account Support by e-mail.

Within 24 hours I received an e-mail from "Vicki" at iTunes Customer Support. She wrote:

"When reviewing over your account "name@domain.net" and the two reported orders, it shows that the content purchased within them was acquired from the computer that is currently authorized for your iTunes account. So I strongly advise that you do consult with those in your household regarding the purchases made, and the charges that resulted from those purchases."

Further:

"I have gone and reversed the charges for the two orders....You will see a store credit in three to five business days....Please note that this is a one-time exception, as the iTunes Store Terms and Conditions state that all sales are final."

I am pleased that Apple is refunding my store credit and replied so quickly.

However, it is simply impossible that these purchases were made from my computer. Again, my Powerbook is the only computer I have ever authorized to access my account, and I am the only person with access to it.

I am not sure how this happened. Any thoughts or similar experiences?

Powerbook G4, Mac OS X (10.5.8)

Posted on Nov 28, 2010 3:45 PM

Close
stereocourier

Q: iTunes store account hacked

  • All replies
  • Helpful answers

first Previous Page 11 of 131 last Next

  • by Carl Johnson,

    Carl Johnson Carl Johnson Mar 17, 2011 4:24 AM in response to Carl Johnson
    Level 1 (80 points)
    Mar 17, 2011 4:24 AM in response to Carl Johnson
    Apple has restored my balance and my account. You have to go through a few steps to re-establish your account, but the account representative guided me through it well. I had pointed out this discussion thread to her, and she responded:
    "Carl, in regards to the discussion link you provided, please know that we are aware of this, and that we are investigating this matter, as dealing with unauthorized purchases is not something Apple takes lightly."

    I'm satisfied for now, but I sure hope they find a way to resolve this, as it seems to have been going on for some time.

  • by kwoo2000,

    kwoo2000 kwoo2000 Mar 17, 2011 5:40 AM in response to stereocourier
    Level 1 (0 points)
    Mar 17, 2011 5:40 AM in response to stereocourier
    Same thing happened to me on 3/16/11. $19.99 taken from my account for Texas Hold'em (but I don't even have this app). If you go to view your purchases, it appeared with a bunch of other apps that were being updated - but I know that I did not purchase Texas Hold'em. There is a link to report a problem next to each purchase, but it just takes you to a generic page where you have to figure out how to report the problem. I finally think I figured out how to submit, and am now waiting to hear from apple.

    I didn't realize that it was related until reading this that "Towson, MD" had replaced my actual city/state/zip, nor that my credit card on file had been deleted.

    Now, I won't redeem gift cards until I am ready to purchase something.

  • by Jeof,

    Jeof Jeof Mar 17, 2011 9:36 AM in response to BradGTX77
    Level 1 (0 points)
    Mar 17, 2011 9:36 AM in response to BradGTX77
    Purchased on 3/16/11
    1 帝國 Online, 23400銀幣禮包, Seller: GAMEISLIVE CORPORATION LIMITED $19.99
    2 帝國 Online, 23400銀幣禮包, Seller: GAMEISLIVE CORPORATION LIMITED $19.99
    3 帝國 Online, 10530銀幣禮包, Seller: GAMEISLIVE CORPORATION LIMITED $9.99
    The Artist listed for these is Lakoo.

    My address also changed to Towson, MD

    exact problem with me last night. i contacted apple and am waiting for a response. I hope i they take care of this soon. My apple trust meter just went down to .01%

  • by Nalberici,

    Nalberici Nalberici Mar 17, 2011 10:18 AM in response to stereocourier
    Level 1 (0 points)
    Mar 17, 2011 10:18 AM in response to stereocourier
    *德州撲克(Texas Hold'em), 560,000 chips, Seller: Hongbin Suo $19.99*

    Just as an FYI because it seems that a lot of people are having these issues (as well as I).... I purchased an iTunes gift card at Best Buy, activated card and within 24hrs this purchased occurred.

    I have reported to Apple / Removed App / Changed Password.

    _I am concerned and I am not sure if anyone else has had this issue:_
    My credit card information was removed from my account, has anyone had any issues with unauthorized purchases outside of Apple?

    Thanks

  • by arcane93,

    arcane93 arcane93 Mar 17, 2011 8:39 PM in response to stereocourier
    Level 1 (10 points)
    Mar 17, 2011 8:39 PM in response to stereocourier
    Managed to get my account unlocked finally. They made me change my password again, despite the fact that I had told them that I had already changed it. What a pain. The response message that I got back focused solely on password issues, with no mention of the other info and suggestions that I shared. I have no confidence at this point that they're going to do anything about the issue, at least until a lot more people have complained.

    I decided that I'm not taking any chances by leaving any gift card credit on my account for now, so I bought a few apps that I'd been thinking about with the balance that I had left to clear it out. I'm also not leaving a credit card number on my account for now -- if I really want to buy something, I'll put it on the account, and then take it right back off after the purchase is made. A lot of hassle (so I'll have to really want whatever I'm buying), but better than having to deal with disputing unauthorized charges (as a bonus, it'll probably keep me from buying a lot of worthless junk as well!). Otherwise I guess it's just free apps for me for a while. Hopefully Apple manages to resolve all of this soon.

    @Nalberici -- I don't think you need to worry about your credit card being used outside of Apple, as iTunes masks all but the last four digits when it displays it. Then again, if the hackers have gotten into Apple's servers . . . but hopefully Apple is storing info like that encrypted. I dunno, I wouldn't be too worried right now, just keep an eye things.

  • by Terrence,

    Terrence Terrence Mar 17, 2011 9:04 PM in response to arcane93
    Level 1 (10 points)
    Mar 17, 2011 9:04 PM in response to arcane93
    Congrats on having your account straightened out. But, like you I am not happy with the whole process. At a minimum, there should be a live human in the loop to deal with fraudulently or unauthorized charges to ones account. I should not have to dance through hoops of fiery emails to report that fraud is being committed. I do hope that Apple Inc will realize that there is a liability issue in this continued practice. The larger question at play is.. how did this happen in the 1st place? To argue that it was you and I who were lax and that it was the end user who compromised and exposed their account for hacking, I find it very hard to believe. There definitely is a weakness and an exploit that continues to be at play. In my instance, the hacker did not gain access to my banks CC and initiate charges on that information, but rather was in a position to modify an existing bank CC to change the address, the CC number and the 3/4 digit security code. Once that was done, the hacker was then able to make the purchase of 2 50 dollar gift cards and 1 music track. A check of my bank information showed that I was not charged for it, but yet showed up as an event by the apple itunes store as if I had done so. For me, this occurred the 1st week of November 2010 when I was traveling overseas. As a result of that transaction, and lack of feedback to me, I was unaware that I had any problems with my apple id until 2 months later, when I tried to download a free app from the mac app and the iphone app store. At each time, it said that my apple id was disabled. I would never have guessed that my apple id was disabled since I was still able to log into my itunes store account and view my history. Likewise, i was able to log into the support area of this web site with my apple id to view and to leave messages. It was only when I attempted to purchase or download free apps, that I had any idea that there was a problem. To me, this isn't acceptable. The way I view it, if there is a problem with my Apple ID, I need to know ASAP without delay. That is a vulnerability that needed to be fixed immediately and not some 2 weeks or 2 months later. As a test..after my account was re activated so that I could download apps and music tracks, I purchased a 15.00 gift card and now have it up on my account. Every day, I check to see if it has been nibbled on. Every other day, I run MacScan and iAntivirus. In the meantime, I don't have any payment information on file other than the itunes gift card sitting there as bait.
    It sure sounds like there are some Asian hackers on the loose that managed to post their apps to make stealth in app purchases. if that is so, there is a clear need to have that disclosure made. That NO APP can initiate an in app purchase without a confirmation code.

  • by kwoo2000,

    kwoo2000 kwoo2000 Mar 18, 2011 5:30 AM in response to kwoo2000
    Level 1 (0 points)
    Mar 18, 2011 5:30 AM in response to kwoo2000
    As a follow-up, Apple did respond to my report a problem message (I don't think they're even reading this board to look for people to fix) and restored the $19.99 to my account, along with a warning about passwords, and how I can request to unlock my account.

    After reading this board, it seems to me that the hackers are getting in another way - and not from passwords. I did recently change my password last week when I bought the ipad2. I hope the store wasn't compromised then.

  • by creeping death,

    creeping death creeping death Mar 18, 2011 7:31 AM in response to Carl Johnson
    Level 1 (0 points)
    Mar 18, 2011 7:31 AM in response to Carl Johnson
    It's something Apple doesn't take lightly?? Well maybe they could have a phone number to call? Also what about not being able to de-authorize other pc's? I don't have 4 other pc's to authorize so i can shut them all off at once, there should only be 1 authorized pc on my account. So far I'm out ALOT of money and no answer from Apple. I can't track where all the gift cards went, I can't do alot of stuff. All I can do is wait for Apple to "get back" to me?

  • by brad p,

    brad p brad p Mar 18, 2011 7:59 AM in response to creeping death
    Level 1 (4 points)
    Mac OS X
    Mar 18, 2011 7:59 AM in response to creeping death
    im pretty sure you can "un-authorize" computers on the account with in the account.
    i had 5 comp's authorized and canceled all but one, mine....

    best of luck

  • by Dee C,

    Dee C Dee C Mar 18, 2011 11:53 AM in response to stereocourier
    Level 1 (32 points)
    Mar 18, 2011 11:53 AM in response to stereocourier
    Thanks for posting this. Although i haven't been hacked I removed my credit card info so hopefully I will not have an issue in the future.

  • by lizurdmom,

    lizurdmom lizurdmom Mar 18, 2011 5:13 PM in response to stereocourier
    Level 1 (0 points)
    Mar 18, 2011 5:13 PM in response to stereocourier
    This has just happened to me as well. I got 2 emails from Paypal, each about a $40 purchase at Itunes on 3/17/11. Only one shows up on Itunes, but both show pending at my bank. I, of course, couldn't reach a human to take immediate action at Itunes, but was able to cut Itunes off as a payee from my Paypal account right away, through a customer service agent.

    I can't believe this has been going on since late November last year, and is Itunes not found a way to interfere with it

    I changed my Itunes account to form of payment: none.

    I changed my password from a word and 4 numerals, to mix of capital and lowercase letters, symbols, and numbers, and began strengthening other passwords.

    I called the Apple 1800 #, cuz I got there from the Itunes website, but was informed that they(Apple) are not Itunes and they couldn't resolve it for me, however the same helpful customer service agent did send Itunes an email about my account and all the particulars. I then got an email from Itunes that they'd received the report email, it was an automated response, said they'd get back to me within 24 hrs........ I am assuming they will make good my $80 somehow. I don't want account credit at this point, I want a check.

    By the way, the "purchases" I didn't make were both for Itunes gift cards. The one I could see on Itunes said it was for "fds". I don't know who that is. My address, etc. was unchanged.

    THERE SHOULD BE AN ALERT SENT OUT TO ALL ITUNES CUSTOMERS, TO AT LEAST STRENGTHEN THEIR PASSWORDS!

    Good Luck
    Liz

  • by brad p,

    brad p brad p Mar 18, 2011 5:48 PM in response to lizurdmom
    Level 1 (4 points)
    Mac OS X
    Mar 18, 2011 5:48 PM in response to lizurdmom
    well, thats interesting,
    if apple isnt itunes, who the heck is??
    i didnt know they are 2 separate companies...

    Message was edited by: brad p

  • by snackeyg,

    snackeyg snackeyg Mar 19, 2011 3:44 PM in response to bush817
    Level 1 (0 points)
    Mar 19, 2011 3:44 PM in response to bush817
    I just went to the app store and noticed I was short about $10. For some Asian apps I didn't buy. http://i35.photobucket.com/albums/d190/goofeewalden/Untitled-28.jpg

    I reported a problem on both stating I didn't purchase them. Hopefully I can get refunded. I'm glad I don't have a credit card on my account.

  • by Andi...M,

    Andi...M Andi...M Mar 19, 2011 7:34 PM in response to stereocourier
    Level 1 (0 points)
    Mar 19, 2011 7:34 PM in response to stereocourier
    It happened to us too. Our credit card was charged $40.00 twice the cc company declined the charge and put a freeze on the account thankfully or else we probably wouldn't have even noticed the charge. Nothing in our account was changed and nothing shows in our account history.

    I'm not sure how to go forward with payment info since gift cards and Paypal are being compromised as well. I contacted i-tunes but I'm expecting the same canned response they gave everyone else. "Change password..." I hope they realize the need to address this properly. There is no way to feel secure with i-tunes now and even more so if the company sweeps this under the rug.

    HELLO ITUNES LET'S ADDRESS THIS PUBLICLY NOW

  • by arcane93,

    arcane93 arcane93 Mar 19, 2011 7:45 PM in response to Andi...M
    Level 1 (10 points)
    Mar 19, 2011 7:45 PM in response to Andi...M
    Ok, that's just weird . . . So some people are having multiple gift cards charged to their credit card, while others are having their credit card info removed from their profiles? And still others are having credit card numbers that don't belong to them put on their account to make fraudulent purchases?

    I think we've got multiple hackers operating here . . . It's entirely possible that they're all exploiting the same weakness (whatever it might be) to get in, but the different +modi operandi+ at play here would seem to indicate that there are different people at work.

    I guess I feel fortunate that I'm in the group that just had the credit card numbers removed from their accounts. I've been watching my credit card activity, and I haven't seen anything show up on it. Still, I don't think I'll be adding my card back onto my account anytime soon.
first Previous Page 11 of 131 last Next