[SUGGESTION] Email Change
Recently, a friend of mine got their Discord account hacked by a phishing scam.
Account security breaches like these happen all the time - some users aren't as tech savvy, don't take their account security serious (e.g. not having two-factor authentication), so on.
After what happened to my friend I learned today that, in the event that your account is breached, that changing the email of your Discord account only requires the current password, which would be known to a hacker.
Due to this, I believe that Discord should send a verification email to your current email prior to an email switch.
This practice is commonplace with many other websites. If someone does not have access to their current email, then they file a ticket with support to prove their identity.
If Discord does change this security practice to send an email to your current email prior to switching to a new one, then a hacker must have access to your Discord account and your email in order to have full control. This allows for people to re-secure their Discord account if something does go wrong, stopping the spread of a account to account phishing attack and put less stress on Discord Support when issues of account security can be dealt with before it goes too far.
-
Discord does send an email in regards to an email switch. I am also in that category of got phished and my email taken. The kicker, I had 2FA that was supposed to notify me on my phone. I never got a reply and he changed my email, pass, and even got past the 2FA all at the same time. The real thing that needs to happen is an account does get phished, Discord needs to LOCK the account. Thats something that the basic support members should be able to do or even better yet, instead of getting an email saying "If you did not change your email please contact support" just make a feature that allows that person to lock their own account out, that way Discord support can deal with the ticket at a later date instead of letting the hacker run amock for over 2 weeks like my account.
1 -
My friend recently got hacked by a fake bot invite website (The person who suggested the bot was also hacked) and he (my friend) assumed nothing was wrong because the two have talked about discord bots in the past and he (my friend) knew the person was interested in making discord bots.
So he went via the process to invite the bot to his discord and from what I gathered, the site looked like discords login process but only be looking closely can you tell it's not actually discord. So the hacker now has an email, password and an authentication code or can keep the session active from my friend attempting to login.
After that all the hacker has to do is change the email and reuse the submitted password. And that's how he lost his discord account.This can easily be stopped by using 2FA, SMS authentication or sending a confirmation email to the current address.
0 -
Problem is, I had 2FA and regardless of the security that Discord has available the hacker easily got past it, which leads me to believe that Discord's 2FA doesnt actually work.
0 -
It doesn't. I have discord 2FA. I got hacked. My friend was hacked and I can't log in anymore cause they got access to my account and changed my email. I am on the process of trying to get my account back and keep spamming them. If you know the light at the end of the tunnel please let me know.
0 -
NGL, I am getting mad depressed from the lack of response and seeing how many more are gone.
0 -
Bro the hacker charged me $40 dollars worth of what i guess are server boosts, I sent in a ticket THAT DAY. they sent me the usual "We are escalating it" and then nothing happens. After 2+weeks they finally did something. They closed my ticket. Charges still there but they closed it. Made a new ticket that was a reply to the closed ticket asking why it was labeled as closed. They completed that one too...and the next one...and the next one. I made a complaint with the Better Business Bureau in California against Discord. Seems like there I am not the only person with complaints about their Support Team. As for the light at the end of the tunnel? IDK man...unless they change their staff to people who actually work then i dont think there is much we can do.
0 -
Wait, so you got charged 40 dollars and never got your account back is what I am reading??? Decarna
0 -
I think they meant that the person paid for $40 worth of nitro boosts on the account with the attached PayPal
0 -
Yeah basically. The hacker stole my account on 8/31/21. Got charged probably from the hacker using my card (even though I had removed my cards info from the account after Discord took all the people who were grandfathered in to Discords Nitro subs got screwed when they decided to revoke our "Original Member" perk) and Discord Support told me not to Dispute the Charges. Well its been 2+ weeks, nothing was done, so my credit card company is Disputing the charges and I will probably permanately lose my account since Discords TOS can let them remove my account if I dispute charges. So Yeah, no account, and Discord earned $40 thanks to their Hacker they are not punishing.
0 -
Also no, its not Paypal, its my card. I was an old enough member that PayPal wasnt an option for paying for Nitro.
0 -
I get that he/she did get charged that. I also got charged as well. But Paypal stopped that transaction. But I was wondering at the end if they got their account back.
0 -
Wait, that is absolutely crapshoot. Tbh I don't mind getting a 40 dollar hit if I can get my account back as long as nothing gets trashed or trashed too much. I know I'm being a dent, but basically you lose 40 dollars and you can't get your account back. And even IF you do get it back because you disputed the charges you can lose your account even when you got it back. Like what kind of crapshoot is this..
0 -
lol, Pending approval? my comment is Pending Approval?
0 -
dude...I have a comment pending approval...hilarious
0 -
Yo add me? Lannister#0766
0 -
Decarna
0 -
But I had to change my wording to circumvent the pending approval lul. But yeah I am really sad, I wanted to get some of my stuff back. The hacker is not even responding to me :(
0 -
I'll add later tonight. I work 3rd shift and need sleep.
0
Please sign in to leave a comment.
Comments
18 comments