Recently, my friend's Skype account was hacked, and the scammers started asking all of his contacts to transfer money, pretending to be him. He had a lot of people in his contact list, around 300. In the first hour alone, the scammers received over 100,000 rubles.
Here's how the thieves operated. They asked for 15,000 rubles – the maximum amount that can be transferred at once via a Yandex wallet. There were no desperate pleas or elaborate stories; instead, the requests to "send 15,000 rubles by tomorrow" were made without details or formalities, to avoid attracting too much attention and prevent a direct call to the real Skype account owner...
When they started investigating and trying to stop the scam, it turned out to be more complicated than expected...
The correspondence with customer support in English took several days, during which the staff couldn't understand what was happening for over a day. When they finally realized that the Skype account had been hacked, they sent a link to the password change form. They had to repeat that the email address had been changed by the scammers and that it wouldn't be possible to regain access using traditional methods.
As a result, customer support sent a link to verify the user's identity and asked to complete it twice. By that time, it was already the third day since the "hijacking," and the scammers were still sending out their requests. Skype refused to block the account until all the circumstances were clarified.
All the questions from the user verification service were answered correctly, except for the question "Date your account was created." As a result, customer support sent a message saying that everything was very complicated and unclear, and the best thing the owner of the stolen account could do... was to create a new one. By the time this article was being written, the total amount of transfers had exceeded 250,000 rubles...
In a private conversation with one of the users, the scammers behaved quite calmly and openly laughed at the threats to go to the police. Apparently, they are well aware of the shortcomings of our legislation and Skype's security policy. As a result, nothing has changed in the past week.
It seems that the only effective measure in this case is to prevent your accounts from being hijacked anywhere. Here are some tips:
- The most reliable, effective, and yet most ignored advice is to set a strong password! It seems that this has been said and written many times, but nevertheless, there are still people who take it lightly.
- Don't use the same password for different accounts; otherwise, if one is hacked, you will lose all the others.
- Link your account to your phone number. This is also called two-factor authentication. If you enter the correct password, you will receive a short digital code on your phone, which will confirm that the person logging in is the real owner and not a scammer who has guessed the password.
- Don't click on suspicious links: many pages intercept your data. Also, don't respond to or send anything to unfamiliar addresses in your email.