Verification code scams?

[u/SapGreenJacket]

Hi, for a while now I've been getting texts about verification codes. I've been ignoring them but am wondering whether I should be worried and what I could possibly do about it. Anyone else experiencing this?

[u/Drackunn]

if it's not an app you use, it's someone using your email/phone to create an account.

I've had this happen as well

[u/SapGreenJacket → u/Drackunn]

That's crazy. Thanks for the info! 

[u/ottoradio]

Do you use the applications which you are getting 2FA's for? First one is Mutualité Neutre and second one is My Pension?

If yes: CHANGE YOUR PASSWORDS! Not only on those platforms. But everywhere. It means your usernames and passwords are compromised, and someone or more probably something (bots) is actively trying to log in with your credentials. They might even succeed for services or applications where 2FA isn't enabled.

Check HaveIBeenPwned or similar services for data leaks your credentials are part of. (you'll probably find some).

General advice: do change passwords regularly, use different and strong passwords for different applications/services/websites, always enable 2FA if possible.

[u/SapGreenJacket → u/ottoradio]

Thanks! I don't use MN so that's something. I'll check out the haveibeenpwnd too. 

[u/Isotheis]

2FA doing its job, I suppose? But that means someone got the correct password, so it should be changed...

[u/laplongejr → u/Isotheis]

Annoyingly I once got a verification code that didn't say which service required it. It also didn't match the format of any account I use normally...
So I have an account that requires a password change but can't do it because whoever made their 2FA forgot the whole point of having a Second factor.

[u/Kitchen-Ebb30 → u/Isotheis]

I get this verification codes for sites I don't use. 

[u/Isotheis → u/Kitchen-Ebb30]

Perhaps someone who managed to sign up somewhere by putting a random phone number...

[u/Inquatitis → u/Isotheis]

That's not necessarily true, many services do passworldless signins just requiring you to authenticate using something external to the site.

[u/Particular_Bug0]

If these are apps/systems you recognize, you should definitely start changing your passwords

[u/saschaleib]

I had this last week. It was then followed by a robocall about a supposed large purchase that was done in my name. I hung up at this point, because it was clear that the idea was to trick me into answering the call and then they would try to extract some information that could be made into money.

The messages were just the "scene setting" to scare you to think that "something is going on".

After the phone call the messages stopped (and yes, I checked my bank account and there were no suspicious activities. It is all just FUD).

[u/A_Man_Uses_A_Name]

I often get through 8001 the message: “Code voor eenmalig gebruik voor het Microsoft-account: *****” with a code I didn’t ask for. We do use Microsoft as so many ppl. I ignore the messages but is the message legit and is someone trying to hack our system?

[u/JonPX → u/A_Man_Uses_A_Name]

Two options, someone knows is phishing you or someone has your password. The safe approach is to check any login attempts on your Microsoft account.

[u/miRRacolix → u/A_Man_Uses_A_Name]

Can I have the massages then? Looking forward to your replay!

[u/A_Man_Uses_A_Name → u/miRRacolix]

Lol + edited.

[u/kiliandj]

Quite a lot of people are getting these lately. Source: am a 1st line it support.

One of many reasons why you should never use sms or email as mfa/2fa. Not even as a backup. Why?

Because security is only as good as the weakest entry point. An authenticator is useless if it can be bypassed using these plaintext unencrypted backups like sms or email. Just like a strong chain is useless if there is 1 bad chackle. And on top of that, as you see, these 2 methods are often faked pretty convincingly.

[u/reusens]

I have the same since my number changed to Orange. Might be a coincidence.

ETA: these are not services I use. I think something has tried to use my number to subscribe to these things and is now locked out... likely because my number changed provider

[u/Neomatrix_45]

Ik kreeg voorbije jaar vaker zo'n smsen. Eerste keer toen ik zo'n reeks van 5+ smsen kreeg heb ik alles extra hard beveiligd, later kreeg ik alweer zo'n reeks van smsen aan en gewoon genegeerd. Zijn ook telkens sites waar ik nog nooit ben op geweest.

[u/Kennyvee98]

Me too :D annoying AF

[u/Fluonix]

Ik kreeg gisteren ook een berichtje met een code voor een Microsoft account. Maar dat was geen 8000 nummer. Was eentje met de landcode van Namibië.

[u/Amelsander]

er is een grote gedocumenteerde breach geweest eerder dit jaar, nu begint die stillaan dit effect te triggeren. check even op haveibeenpwnd of je e-mail adres in de breach zat

[u/Flake_3418]

Yh i have been getting these aswell. For services i never used and once without a service being specified

[u/Recognition_Round]

I get these verification codes for stuff i never ever used.

[u/Famous_Marketing1009]

Yes, I keep getting those and have to throw that crap in the trash.

[u/Agreeable_You_8841]

Don't worry. The scammers need the code to proceed