ZoS just gave someone's account away?!

IrishOphidia

So a friend of our's had their account stolen. I've heard of this scam before. They submit a ticket claiming the account was stolen from them and ZoS just gives them the account without contacting the owner of the account at all. The account's current owner is going by [snip]. @ZOS_GinaBruno or any other dev's assisstance on this would be appreciated.

[edited for naming-and-shaming]

Daemons_Bane

Not sure why you would post that here.. especially when you add their account name

Ruder

it is not that simple as you make it to be, to steal account they don't have to contact ZOS at all, all they need is your Email and Email password and no ZOS won't give them back the account, if they do not know the email of the account, the only other possibility is if they have the account digital CD-key of the first bought copy of the game.

IrishOphidia

Ruder wrote: »

it is not that simple as you make it to be, to steal account they don't have to contact ZOS at all, all they need is your Email and Email password and no ZOS won't give them back the account, if they do not know the email of the account, the only other possibility is if they have the account digital CD-key of the first bought copy of the game.

Even if they knew the email on the account, you’re telling me ZoS doesn’t even email the account to inform them?

IrishOphidia

Daemons_Bane wrote: »

Not sure why you would post that here.. especially when you add their account name

Of course I’m going to add the name. They’ve changed it twice now so it’s probably already something different. If ZoS would actually respond to tickets being submitted about this situation then I wouldn’t have to come here. The original owner has spent 100s if not 1000s of dollars on this account and for it to just be taken from them is disgusting. The fact that someone can even steal an account without knowing the passwords is poor security. If all I need is the person’s email for the account to steal it is garbage.

zaria

The lack of any sort of two factor authentication is an serious weakness in ESO.

Donny_Vito

I'm very sorry to hear this, but there is typically a "forgot password" type of functionality where the person must have access to your email in order to get that link or some other form of authentication. It seems like you're implying that [BadPerson] sent a message to ZoS saying "this is my email, please send me the password for it using this other email I'm contacting you on" and then ZoS did, which I cannot believe. This [BadPerson] had to have sensitive data about your friends account and/or CC information in order to authenticate.

IrishOphidia

Donny_Vito wrote: »

I'm very sorry to hear this, but there is typically a "forgot password" type of functionality where the person must have access to your email in order to get that link or some other form of authentication. It seems like you're implying that [BadPerson] sent a message to ZoS saying "this is my email, please send me the password for it using this other email I'm contacting you on" and then ZoS did, which I cannot believe. This [BadPerson] had to have sensitive data about your friends account and/or CC information in order to authenticate.

We’re trying to figure out how that is possible which is why we’d like a response from anyone at ZoS, but have received no responses.

Ruder

IrishOphidia wrote: »

Ruder wrote: »

it is not that simple as you make it to be, to steal account they don't have to contact ZOS at all, all they need is your Email and Email password and no ZOS won't give them back the account, if they do not know the email of the account, the only other possibility is if they have the account digital CD-key of the first bought copy of the game.

Even if they knew the email on the account, you’re telling me ZoS doesn’t even email the account to inform them?

There is nothing to inform there [snip], if they know your Email and password, they can do anything, including transfer the account to other Email.

Any notifications sent by ZOS for account activity can be easily deleted, ti is that simple.

[edited for baiting]

ZOS_Adrikoth

Greetings @IrishOphidia

If you haven't already, please ensure that your friend submits an Account Recovery ticket with us here. That will ensure that the proper team reviews this incident.

IrishOphidia

Ruder wrote: »

IrishOphidia wrote: »

Ruder wrote: »

it is not that simple as you make it to be, to steal account they don't have to contact ZOS at all, all they need is your Email and Email password and no ZOS won't give them back the account, if they do not know the email of the account, the only other possibility is if they have the account digital CD-key of the first bought copy of the game.

Even if they knew the email on the account, you’re telling me ZoS doesn’t even email the account to inform them?

There is nothing to inform there [snip], if they know your Email and password, they can do anything, including transfer the account to other Email.

Any notifications sent by ZOS for account activity can be easily deleted, ti is that simple.

They’d have to have access to the actual email to delete notifications from ZoS. When you report an account stolen there’s literally an option that says “I cannot be reached at this email” when you enter the email on the account.

IrishOphidia

ZOS_Adrikoth wrote: »

Greetings @IrishOphidia

If you haven't already, please ensure that your friend submits an Account Recovery ticket with us here. That will ensure that the proper team reviews this incident.

Has done twice. Thank you for the response.

Sarannah

If your story is correct, the e-mail associated with the game account was hacked and is still being used by the hacker(or changed to a new one). As ZOS e-mails with every account change, and with log in codes. This would show someone has deleted those e-mails, even if it was only for the account e-mail change and first time log-in of the game account.

My advice would be to secure the e-mail account with 2-way authentication, and then submit a ticket to ZOS about the game-account being compromised(including a possible e-mail change done by the hacker). With as much information as possible, about being the real owner of the account.

IrishOphidia

Sarannah wrote: »

If your story is correct, the e-mail associated with the game account was hacked and is still being used by the hacker(or changed to a new one). As ZOS e-mails with every account change, and with log in codes. This would show someone has deleted those e-mails, even if it was only for the account e-mail change and first time log-in of the game account.

My advice would be to secure the e-mail account with 2-way authentication, and then submit a ticket to ZOS about the game-account being compromised(including a possible e-mail change done by the hacker). With as much information as possible, about being the real owner of the account.

I’ll pass that on. Thank you.

Taleof2Cities

IrishOphidia wrote: »

ZOS_Adrikoth wrote: »

Greetings @IrishOphidia

If you haven't already, please ensure that your friend submits an Account Recovery ticket with us here. That will ensure that the proper team reviews this incident.

Has done twice. Thank you for the response.

Make sure you (or your friend) lists the ticket number in the thread here so the friendly forums mods can check on the status.

Submitting multiple tickets is not recommended ... as it puts the original ticket back to the back of the Support queue.

IrishOphidia

Taleof2Cities wrote: »

IrishOphidia wrote: »

ZOS_Adrikoth wrote: »

Greetings @IrishOphidia

If you haven't already, please ensure that your friend submits an Account Recovery ticket with us here. That will ensure that the proper team reviews this incident.

Has done twice. Thank you for the response.

Make sure you (or your friend) lists the ticket number in the thread here so the friendly forums mods can check on the status.

Submitting multiple tickets is not recommended ... as it puts the original ticket back to the back of the Support queue.

Good point. They've made contact, but thank you for the future reference.