[SOLVED]My account was changed email

[Wapfika]

My account recently changed email to something like ***bounce@invalid.com without my consent. I immediately change password and activate 2FA after noticing this notification when I try to view my trust page.

I’m not sure if this hacker or forum default. Is there anyone here experienced the same issue. My IP log shows there’s no anomaly since it’s all from Philippines. If ever my account will ask for loan or deal business please don’t deal with me. I will never ask for loan or any business here.


Answer:

This is something we recently started doing. If email sent to your email address bounces with an error message like, "This email address doesn't exist", then your email may eventually be changed to u...@bounces.invalid. (It's not possible for users to change their email address to something ending in .invalid, so this can only be an administrative change.) Because your old email didn't exist, somebody could've registered your non-existent email address and used that to steal your account.

I didn't particularly intend for the trust warning to appear for these automatic changes, but it's a niche situation and a bit difficult to fix, so I probably won't fix this unless several other people complain. It only lasts 30 days, after all.

[un_rank]

It is a hacker. The forum does not change email or any other profile information of members.

Think of possible ways your password or email could have been compromised and consider securing your other accounts on your device in case they were also compromised.

- Jay -

[Awaklara]

Maybe you forgot that you ever accessed your account on another device, for example borrowing a friend's device or renting a computer service. usually, after an account is logged out on one device, the login on the other device will also be logged out.
Was the last time you accessed your account you were asked to log in again?
If it's hacked, maybe the password will change or something. When there is a change in email, the perpetrator must get your account password. but it's strange how come only the email address has been changed?

[Despairo]

I guess it's forum default, there are many reasons behind that but it mostly related to the email is unavailable. You need to confirm if you're able to login your old email or not, because I can login to my email and my email doesn't changed automatically like yours.

I've leave neutral tag in your profile.

Code:

Despairo	2024-02-06	Reference	This user don't want to take any loan or any other financial deal in this forum. (Delete) 

[PytagoraZ]

My account recently changed email to something like ***bounce@invalid.com without my consent. I immediately change password and activate 2FA after noticing this notification when I try to view my trust page.

Maybe you should restore your account to your own email. Will the main email receive notifications when there is an email change? I haven't used FA yet, but I will be activating it soon due to reading your story. Hopefully your account is fine and you need to check your computer for malicious software.

Whether this incident has an impact on your wallet or not, you may want to consider changing your wallet for campaign payments. Before it's too late

[Adbitco]

I will advise you to change back your email is good you have added 2fa this will protect you from hack, then again if you haven't sign any message before try to sign one to protect your account from totally stolen from you.
We have heard numerous stories about account requesting for a loan without them applying for it. You can also change your password to a more solidify one.

[theymos]

This is something we recently started doing. If email sent to your email address bounces with an error message like, "This email address doesn't exist", then your email may eventually be changed to u...@bounces.invalid. (It's not possible for users to change their email address to something ending in .invalid, so this can only be an administrative change.) Because your old email didn't exist, somebody could've registered your non-existent email address and used that to steal your account.

I didn't particularly intend for the trust warning to appear for these automatic changes, but it's a niche situation and a bit difficult to fix, so I probably won't fix this unless several other people complain. It only lasts 30 days, after all.

[Shishir99]

This is something we recently started doing. If email sent to your email address bounces with an error message like, "This email address doesn't exist", then your email may eventually be changed to u...@bounces.invalid. (It's not possible for users to change their email address to something ending in .invalid, so this can only be an administrative change.) Because your old email didn't exist, somebody could've registered your non-existent email address and used that to steal your account.

LOL theymos. You could have warned us instead of silently doing this so we don't get scared. My email is the correct one and I always receive emails if I get any private messages. I am sure Wapfika's soul was out of his body for a moment when he saw the new email was set on his account. But it is good that he enabled 2FA.

We have been seeing accounts getting compromised and those accounts were used to ask for a loan but the hacker didn't try to steal the account. The good thing is you have already implemented 2FA. Every user is advised to enable 2FA if they doubt about their security.

[joker_josue]

This is something we recently started doing. If email sent to your email address bounces with an error message like, "This email address doesn't exist", then your email may eventually be changed to u...@bounces.invalid. (It's not possible for users to change their email address to something ending in .invalid, so this can only be an administrative change.) Because your old email didn't exist, somebody could've registered your non-existent email address and used that to steal your account.

I didn't particularly intend for the trust warning to appear for these automatic changes, but it's a niche situation and a bit difficult to fix, so I probably won't fix this unless several other people complain. It only lasts 30 days, after all.

I think this was/is an excellent measure. I don't see anything wrong with this message, because it is an alert that the previous email is no longer being used, especially in accounts where the email is visible to the public.

Now, I really could have given some information about these security measures. Unless the measure is no longer new, and was reported at the time.

Continuation of a good work.

[Potato Chips]

This is something we recently started doing. If email sent to your email address bounces with an error message like, "This email address doesn't exist", then your email may eventually be changed to u...@bounces.invalid. (It's not possible for users to change their email address to something ending in .invalid, so this can only be an administrative change.) Because your old email didn't exist, somebody could've registered your non-existent email address and used that to steal your account.

I didn't particularly intend for the trust warning to appear for these automatic changes, but it's a niche situation and a bit difficult to fix, so I probably won't fix this unless several other people complain. It only lasts 30 days, after all.

It's a nice touch actually! particularly for inactive account policy some email providers have. I could see some members creating an email account solely for bitcointalk then forgetting to log back for a year or two so their account gets removed due to being inactive.

I wonder if op was using gmail? because google has recently started deleting inactive accounts:

When your Google Account has not been used within a 2-year period, your Google Account, that is then deemed inactive, and all of its content and data may be deleted.

... December 1, 2023 is the earliest a Google Account will be deleted due to this policy.

[Wapfika]

This is something we recently started doing. If email sent to your email address bounces with an error message like, "This email address doesn't exist", then your email may eventually be changed to u...@bounces.invalid. (It's not possible for users to change their email address to something ending in .invalid, so this can only be an administrative change.) Because your old email didn't exist, somebody could've registered your non-existent email address and used that to steal your account.

I didn't particularly intend for the trust warning to appear for these automatic changes, but it's a niche situation and a bit difficult to fix, so I probably won't fix this unless several other people complain. It only lasts 30 days, after all.

Thank you very much @theymos for the reply. I just remember that I use an e-mail that I plan to create uniquely for my bitcointalk but I forget to do so like many years ago.


I will keep the thread open for a while for anyone who has anything to say on this update. I already updated the OP to include @theymos official response and mark the title as solve to help other user informed in case they encounter same confusion like what I did. Thanks guys!

[Nwada001]

Thank you very much @theymos for the reply. I just remember that I use an e-mail that I plan to create uniquely for my bitcointalk but I forget to do so like many years ago.


I will keep the thread open for a while for anyone who has anything to say on this update. I already updated the OP to include @theymos official response and mark the title as solve to help other user informed in case they encounter same confusion like what I did. Thanks guys!

I also happen to have created my own account with an invalid email as of the time I registered it, but after I started being active here, I saw a need to register that email and make it valid. This is because there might be a need for that email in the future, which I can never tell for now.
 
This unexisting email that is used to create a Bitcointalk account is, I believe, very popular among members here since the forum doesn't request email confirmation before they proceed with the registration.
 
I believe such a method might be for privacy reasons, and the forum also doesn't send news letters to members using the email. If it's becoming a thing of concern, I will suggest that for new member registration, email confirmation before proceeding be mandatory to confirm if the email is valid.

[dkbit98]

This is something we recently started doing. If email sent to your email address bounces with an error message like, "This email address doesn't exist", then your email may eventually be changed to u...@bounces.invalid. (It's not possible for users to change their email address to something ending in .invalid, so this can only be an administrative change.) Because your old email didn't exist, somebody could've registered your non-existent email address and used that to steal your account.

That means that majority of old inactive accounts could soon have changes email addresses in the same way.
It's a good security measure but it would be better if this was announced before it started happening, maybe some members would do a manual change.
Another possible issue is if email can't be received temporary, because of maintenance or outage.

I wonder if op was using gmail? because google has recently started deleting inactive accounts

Exactly!
I was thinking the same thing, and they also deleted ALL old cache links, so you won't find anything old from bitcointalk anymore!
https://searchengineland.com/google-search-officially-retires-cache-link-437122

Anyone who wants to research old Bitcointalk pages can still do it here with Wayback Machine:
https://wayback-classic.net/

[PytagoraZ]

Thank you very much @theymos for the reply. I just remember that I use an e-mail that I plan to create uniquely for my bitcointalk but I forget to do so like many years ago.

OMG, your little mistake made the bitcointalk world in an uproar, until the admin had to intervene. Lol 

[GeorgeJohn]

I don't know what's happening in the forum right now, it seems that hackers has come back to the forum fully to the extent of hackers trying to change someone's email so that they can get access to the account..I think its abnormal and the administrators of forum and theymos have to take adequate care of this situation before many of us will lose it account, because some of the sold accounts are hacked account and this is a measure they got their accounts,  so whatever we are doing we need to eliminate this kind of act, few days ago someone pm me asking me if I will sell my account that means the person is try to redeem my account.

[DYING_S0UL]

If email sent to your email address bounces with an error message like, "This email address doesn't exist", then your email may eventually be changed to u...@bounces.invalid.

So what happens if an existing email address suppose "testmail123@gmail.com" gets disable or ban for some unknown reason? The address won't exist then. Google recently made a new policy where inactive gmail are deleted.

[Faisal2202]

I don't know what's happening in the forum right now, it seems that hackers has come back to the forum fully to the extent of hackers trying to change someone's email so that they can get access to the account..I think its abnormal and the administrators of forum and theymos have to take adequate care of this situation before many of us will lose it account, because some of the sold accounts are hacked account and this is a measure they got their accounts,  so whatever we are doing we need to eliminate this kind of act, few days ago someone pm me asking me if I will sell my account that means the person is try to redeem my account.

Hackers and scammers are not new to this forum, and account selling as well, many members got caught in the dealing of selling and buying accounts, I even saw a listing of accounts on some websites, well the point is we should take proper precautions to safe ourselves from such hacks. Thanks to admin we got 2FA now and this bounce email feature also doing great work.

I hope you already have checked the admin's reply to OP's question, if the email no longer exists then the account's email will be changed to the @bounces.invalid. to avoid unauthorized access to someone's account, Op did great by noticing the issue but I am amazed to see why admins did not said something before.

[theymos]

I thought people would quickly figure out on their own from the new email address what happened, but maybe it's not as clear as I thought. Maybe later I'll put a big red notice about it on the Account Settings page if you've been affected, especially if more people keep coming to Meta and asking about it.

So what happens if an existing email address suppose "testmail123@gmail.com" gets disable or ban for some unknown reason? The address won't exist then. Google recently made a new policy where inactive gmail are deleted.

You weren't receiving email before because your email got banned/disabled, and now you'll still not be receiving email. Nothing is lost. The forum account isn't banned or anything.

Another possible issue is if email can't be received temporary, because of maintenance or outage.

If it's temporarily down, then it won't give a bounce message of "No such mailbox" (or similar), so the email won't be affected. Gmail for example responds via SMTP, "550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1  https://support.google.com/mail/?p=NoSuchUser". We're detecting several variations on that "no such user" SMTP response.

Longer-term, I would also like to do something about emails where the domain times-out or returns a "temporary" error in like 3 of the last 12 months or something like that. If you register with an email like asdfwerwe@werwetwerwer.com, then somebody could register werwetwerwer.com and steal the account that way. But this issue isn't on my short-term to-do list at all.

[SatoPrincess]

I don't know what's happening in the forum right now, it seems that hackers has come back to the forum fully to the extent of hackers trying to change someone's email so that they can get access to the account..I think its abnormal and the administrators of forum and theymos have to take adequate care of this situation before many of us will lose it account, because some of the sold accounts are hacked account and this is a measure they got their accounts,  so whatever we are doing we need to eliminate this kind of act, few days ago someone pm me asking me if I will sell my account that means the person is try to redeem my account.

I don’t believe it’s the work of hackers. I noticed the same thing on my profile some weeks ago. I panicked at first, I checked meta to see if anyone had any similar complaint. There was none, then I remembered the email address I used to create my account was a made up one. The only logical thing to do was to change my email address and that was how everything returned to normal. I’m surprised no one noticed it until now, looks like most people have a valid email on their bitcointalk account.

P.S. Just noticed bpip.org doesn’t show email change anymore.

[GeorgeJohn]

You weren't receiving email before because your email got banned/disabled, and now you'll still not be receiving email. Nothing is lost. The forum account isn't banned or anything.

I want to get a clear scenario from you theymos, if email is been ban or got disabled and the user of the bitcointalk account have not noticed for long period that his email is not in function and  a hacker has penetrate to his bitcointalk account and succeeded hacking the user account, can the person retrieve it's account through the management of the forum while it has not sign a message with its receiving address of the first earn for the forum??