Ask HN: Someone is using my email to register to a bunch of services

[avitzurel]

Hey all,

In the last 20 minutes, I got probably around 200 emails congratulating me on registering to the website/newsletter.

This is my personal email

In addition, my credit card has been used to purchase 850$ worth of goods (called Amex, canceled the card).

I changed my email password obviously, canceled the card.

What else can I do? Did this ever happen to you? Have any advice?

[avitzurel]

I am posting some information here in case someone encounters this.

This seems like a type of DDOS attack to hide an email from a financial service.

All of these emails are essentially meant to hide the order of 850$ in the flurry of other emails.

Some information from a Google thread: https://support.google.com/mail/forum/AAAAK7un8RUCTPjR3thcdQ...

[jamil7]

You can check something like https://haveibeenpwned.com/ to see if you can locate where the breach came from. Other than that you just have to assume the worst and start rotating all your passwords and keys. Turn on 2FA for everything.

[johnnyo]

I knew a guy who had a very common email address (like jsmith at popular provider), and it was pretty common for people to sign up to services using that address.

For well designed sites that require verification before the account is setup, just trash the message.

For other stuff, you may have to unsubscribe.

Worst case scenario for something like a dating sites or whatever, you can just reset the password, then login and delete/deactivate the account.

[avitzurel]

This seems scripted. My email is not common.

I am getting ~300 of these from different websites, newsletters, etc.

https://assets.avi.io/Contact_form_-_avikensodev.com_-_Kenso...

[spaceman91]

I wouldn't open the email, click links, or open attachments. Can you think of any place you may have submitted your email or made it public?

[duxup]

A credit freeze might be in order:

https://www.consumer.ftc.gov/articles/0497-credit-freeze-faq...