Velocity Points Stolen

[Jay Greenberg]

Hi All,

Quick post to highlight the fact that a few days ago my mother had 300,000 points "stolen" from here velocity account. They were transferred out from her account by to an unrelated, unauthorised account. See below:

Points transferred to : ANTON ANTONOV
Membership Number : 1168970186
Number of Points transferred : 100000

This happened in three batches.

I suggest Anton Antonov might not be a real name.. or perhaps it is another compromised account.

Anyway, we've raised it with Velocity, and they're going to come back to us within 3-5 days.

Assuming my mother hasn't disclosed her login details via some phishing scheme, the only other explanation is that her user details and password was leaked via some third party hack.

Any other reports of similar stuff going on in the FF community?

 

[AustraliaPoochie]

One possibility is that this person has set up that he is related to your mum.
Possible that your mum's address with VFF mail might have gone walking.
This is only my supposition.
They (the scammer) must have somehow known your mum has a high balance. Takes 5,000 VFF points before any can go out.
Maybe 2factor authentication tion could/would have prevented this, or made it harder, as they would have needed to take over her mobile phone first.
Pity to hear that this now happens to VFF as it is with QFF.

 

[Denali]

Yikes. Keep in contact with VA until these are reversed.

Good luck

 

[RooFlyer]

Welcome to AFF - sorry its under these circumstances.

You might want to edit that account number out; although its not yours, and possibly that of a wrong-do-er, its not adding to the point being made and not good practice to have it in a public forum.

 

[HeavyElectricity]

Assuming my mother hasn't disclosed her login details via some phishing scheme, the only other explanation is that her user details and password was leaked via some third party hack.

Some other common possibilities worth considering:

• Keylogger malware/virus on a computer which was used by the account holder when they logged in.
• Use of a weak/easily guessable password where access was obtained by dictionary attack (guessable/common passwords) or possibly brute-force attack.
• Compromised email account where password reset was triggered (probably not in this case if you are still accessing the account as before).
• Password re-use where the same email/user/password combination were used on another service which was compromised/leaked.