Password changed / Woke up recently. Good signals to know potential scammers

[tbct_mt2]

I read many topics created last two weeks, on phishing, passwords, emails but I don't see anyone discussed or gave information on the available and important signals of very potential scammers.

Password changed!

I knew it by myself when I changed my password (directly after logging in my account), then mis-wrote it down and I have to changed it again through my emails.
Different displayed signals of password change/ reset. (I did it in August this year).

There are two types of signal for password change.


The first one (first line, in Orange) is for: password changed through email.
The second one (second line, in Black, and smaller fontsize) is for:  password changed after logging in account.

The first one is a stronger early signal of potential scammers because scammers or hackers can buy or use hacked accounts (with emails too) to reset passwords.

There is another important signal: Woke up.

If you see one account (in Trust page) shows both of:
- "This user's password was reset recently."
- This user recently woke up from a long period of inactivity (Thanks @SFR10).


I warn you to be highly careful to deal with those types of accounts.

You will rarely see accounts with two lines in the attached image. In contrast, you will usually see accounts with two lines above, in Red and in Orange.

They are very basic things but newbies don't know it and easily get scammed.

They don't have to hack your accounts to steal your money if you blindly give them your money.



Q & A:
1. How to see Trust page?

Click on the trust page, under the avatar of user or at the very bottom in profile page. You will see all of what I mentioned in OP.

2. What does woke-up mean?

Woke up means a user is inactively (not logs in account) for at least 6 months, then suddenly woke up and logged in account.

My main question is, what is the criteria for this to show up?

It shows up if a user has logged in with their last login time being at least 6 months ago.

3. What are meanings of different things I see in Trust page (+ / = / - trusts; flags; feedback)?
They are more addtional details so if you are curious to know more, please read that one: LoyceV's Beginners guide to correct use of the Trust system

4. How long those warnings will be displayed?

A reset will be shown for 30 days, while a password change will be shown for 3 days.

You're considered to have woken up if your last login time is 180+ days ago, and the message remains for 30 days.

I am thankful to all of the users who contributed valuable information and details; some of their contributions help me to improve OP.

[panganib999]

This is in the forum right? Hmmm, its a rather interesting idea to add on to other social media sites or forums. This could potentially be a warning sign for most users that the account might have been hacked, that is the idea behind it right? Question though, how do you get the Woke up thingy? And what does it exactly imply?
Still, that idea was great. Might use it when I make my own forum or something of the sort next time.

[tbct_mt2]

This is in the forum right? Hmmm, its a rather interesting idea to add on to other social media sites or forums. This could potentially be a warning sign for most users that the account might have been hacked, that is the idea behind it right? Question though, how do you get the Woke up thingy? And what does it exactly imply?
Still, that idea was great. Might use it when I make my own forum or something of the sort next time.

Click on the trust page, under the avatar of user or at the very bottom in profile page. You will see all of what I mentioned in OP.

Woke up means a user is inactively (not logs in account) for at least 6 months, then suddenly woke up and logged in account. What kind of purposes of suck woke-up accounts? Not all, but some of them are scammers.

That is why I give you two: woke up and password changed. If you see one account has both of the two, the risk is higher.

Those warnings added as consequence of community suggestions. Before that, and now too, you can manually check it in the page: https://bitcointalk.org/seclog.php (but there is limited time data saved on that page).

[DdmrDdmr]

If we want to get a measure of just how many accounts go around one of these procedures, we can take a look at the SecLog. It displays these circumstances nominally for the past 30 days (there are a few other circumstances for appearing on the Seclog, mostly related to the account recovery procedure and the related status queue).

Surprisingly enough, whilst the average for the last month entails entries for 51 users/day, deploying the Newbies account link moves that figure to 410 user/day. That means that there are eight times more Newbie accounts doing these procedures that non-Newbie accounts …


Some semantics:

My main question is, what is the criteria for this to show up?

It shows up if a user has logged in with their last login time being at least 6 months ago.

[Bttzed03]

I had a quick look at the security log and found these:

November 25, 2019, 01:09:27 PM - xZork - woke up
November 25, 2019, 01:07:51 PM - xZork - password reset via email

November 24, 2019, 08:55:13 PM - catfish - woke up
November 24, 2019, 08:55:09 PM - catfish - password reset via email

Strong signals as mentioned in the OP.

[Coyster]

Email change too could be added to the OP, I believe it could be a sign that the account has either been hacked, or sold(generally changed hands). Once you click on a users trust page, you can see if the user changed email recently.

All these does not make such users scammers, but it's an indicator, a sign, most especially when all three are present, password changed, woke up recently and email changed, you must be careful with that user, and report them to the admin if you receive a pm from them.

[Bitcoin_Arena]

Email change too could be added to the OP, I believe it could be a sign that the account has either been hacked, or sold(generallu changed hands). Once you click on a users trust page, you can see if the user changed email recently.

Email change is one of the strongest proofs that an account probably changed hands. But some scammers and account hackers are starting to become smarter. They don't change the password or email of the hacked account and then they will post scam ads around the forum or send scam PM to other members when the owner of the account is not aware( i have seen this kind of thing happen at-least a half a dozen times though at this time, am not able to retrieve at-least one thread to show some victims complaining about it.)

So bottom line is, one has to be very careful when trading with anyone round the forum whether the password or email was changed recently or not. Hackers/scammers sometimes hide in plain sight.

[JeromeTash]

The recently woke up or password changed warning can disappear after sometime from the profile's trust page making it hard to know if the account is now under control of someone else, therefore, I just wanted to add that Vod's Bitcointalk Public Information Project can also be a good tool in tracking and finding out if an account woke up and it's password was changed in the past [from mid 2018 when the BPIP was launched] even when seclog no longer has such information

[naska21]

Password changed!

I don't think the "password changed" message is something meaningful. That is the widespread practice in password changing on regular basis to increase security of the account. Some services even force you to do that from time to time, IMO.

[tbct_mt2]

I don't think the "password changed" message is something meaningful. That is the widespread practice in password changing on regular basis to increase security of the account. Some services even force you to do that from time to time, IMO.

There are some factors to consider potential scammers.

If you see one account (in Trust page) shows both of:
- "This user's password was reset recently."
- Woke up recently (I don't remember the exact words).

The title is "Password changed / Woke up recently." More exactly, it should be password change and/or woke up recently. If you want to add more email changed recently. In previous posts, people mentioned about BPIP, that I know too. Unfortunately, the site is in updating progress and we might see a totally new version of BPIP soon.

You can combine all three factors:
- Password changed
- Woke up
- Email changed
All done recently. However, in my opinion, only the first two factors are enough to be more cautious with such accounts.

[masulum]

I don't think the "password changed" message is something meaningful. That is the widespread practice in password changing on regular basis to increase security of the account. Some services even force you to do that from time to time, IMO.

If you want to change your password for security reason but someone reporting you did something wrong (such as, hacked account, sell account) to bounty manager and makes you banned from campaign, you can create a clarification signature message with your staked Bitcoin address on this thread .

[tbct_mt2]

Password change is normal but it will turn to be a potential issue if one user is inactive for months (more than 6) or years, then woke-up, reactive and instantly changes password.

If I come back to the forum after months, I don't see why do I  have to change my password, if I don't lose it. I guess most of you do it too. The most common reason of password change is forget password from initial account owners or hacked/ stolen accounts.

Combinations of two or three things aforementioned are issues.

[SFR10]

- Woke up recently (I don't remember the exact words).

Here you go: Direct link

The recently woke up or password changed warning can disappear after sometime from the profile's trust page making it hard to know if the account is now under control of someone else,

Correct...
- The following highlights, might come in handy:

A reset will be shown for 30 days, while a password change will be shown for 3 days.

You're considered to have woken up if your last login time is 180+ days ago, and the message remains for 30 days.

If I come back to the forum after months, I don't see why do I  have to change my password, if I don't lose it.

Even if there's strange activity on your account while you were away? What will be your first step if the person that used your account, didn't change anything?

[tbct_mt2]

Thank you, @SRF10. I added those details in OP.

If I come back to the forum after months, I don't see why do I  have to change my password, if I don't lose it.

Even if there's strange activity on your account while you were away? What will be your first step if the person that used your account, didn't change anything?

Of course, I will change my password if I find out strange activities with my account (log-in IP, and strange PMs in my Outbox).

For one who don't know how to check your log-in IPs (for the last 30 days), visit that page after logging in your account: https://bitcointalk.org/myips.php
Make sure you choose the option: Limit your IP retentionn (Profile --- Account Related Settings --- Choose that option)

It's tricky to get email notifications right so that they're not too spammy. Maybe later.

For now, I added this page where you can see your IP logs for the past 30 days: https://bitcointalk.org/myips.php . You could pretty easily write a userscript to periodically check this and warn you if it's weird. (But don't scrape it on every pageload.)

I don't want to make older IP logs automatically accessible because that'd give a hacker a bunch of useful/sensitive information. But 30 days is probably not too harmful.

[BITCOIN4X]

~snip

I have read your thread from the first to the last reply but havent found what to do with the account when someone gets it?
Give them redtrust or ignore them ?

[DdmrDdmr]

<...> Give them redtrust or ignore them ?

What the OP explains are simply features to watch out for when dealing with an account, especially if the dealing is related to trade, following a link, or interacting with them on a private basis. It is by no means cause for immediate call to action by means of Trust (with the ignore, one can do as they wish, since it is a private matter).

It is merely a caution one should have, and Trust should not enter the equation just because an account has woken-up and/or changed his password. Imagine doing that automatically to the account who’s Id=3, just because it woke-up … That would put us on alert to see what the account does, and act according to the account’s actions from there on.

[BITCOIN4X]

~snip

I havent realized what the main goal of the OP was before, but you explained it well to me. Thanks
But action can be taken when the account is proven to have been hacked and sold or changed ownership when someone has investigated. Maybe as has been done by Veleor, https://bitcointalk.org/index.php?topic=5190670.msg52678334#msg52678334.

[tbct_mt2]

I have read your thread from the first to the last reply but havent found what to do with the account when someone gets it?
Give them redtrust or ignore them ?

If they woke up and don't do anything else, making new posts or running business or making offers with the others; it is not correct to take woke-up accounts. There are thousands of woke up accounts, and not all of them are scammers or bad ones.

I havent realized what the main goal of the OP was before, but you explained it well to me. Thanks

The topic title is clear, bro.
"Good signals to know potential scammers".

[Chivas Regal]

You may find at the moment with the world situation that people are returning to the Bitcoin forum (such as myself) or, they may have simply lost track of certain things such as their password for this forum and have needed to change their passwords, or reactivate their accounts.

[Falconer]

You may find at the moment with the world situation that people are returning to the Bitcoin forum (such as myself) or, they may have simply lost track of certain things such as their password for this forum and have needed to change their passwords, or reactivate their accounts.

I do not consider the case of changing the password or recently waking up as suspicious activity from profile account (like your account). However, in trading and lending they avoid your account because of potential fraud problems but if you can verify the old BTC address then avoid these accusations.