Hotmail account breach -- options?

[chronovore]

A friend of mine is traveling in Japan, had her Hotmail account compromised, and now someone is spamming her address book contacts, talking about being mugged in Malaysia and needing money to get home. The scammers are pretty good; it looks like they didn't mail anyone she's recently been in contact with, or they'd know she's not in Malaysia. She's a public health worker, and the mail mentions attending a valid-looking public health conference, so the mail looks pretty reasonable except for the out-of-the-blue request for 2500 bucks and the mail being address to a BCC list.

They also reset her secret question and alternate email for password recovery, so those aren't an option. The account recovery options aren't working because they've blocked the normal routes. Is there some means of pulling an emergency brake on a Hotmail account?

[tehjaybo]

I think there's some way of contacting the service and confirming your identity, but you'd have to look around the Hotmail site.  Also, I'd check international fraud laws.  If the scammer actually gets any money, or maybe even without that, there may be a way to press identity theft charges, and get some sort of law enforcement in on it.

[Brehvolution]

She needs to change her password.

[chronovore]

She needs to change her password.

They also reset her secret question and alternate email for password recovery, so those aren't an option. The account recovery options aren't working because they've blocked the normal routes. Is there some means of pulling an emergency brake on a Hotmail account?

They had her password. They changed her password. They changed the password recovery options on her account, so the means of changing the password are no longer available to her.

I spent an hour looking for a means of contacting Hotmail support to have them put a hold on the account, take it offline until the issue can be resolved, but couldn't find anything other than this:
https://account.live.com/ResetPassword.aspx

This covers the scenario of a hijacked account, but after sending a password reset to an account that wasn't her alternate email address, it said I had to wait another 24 hours before having other options. It seems strange that they give the thieves additional time to play with the account, but I guess those thieves can strip whatever information they need out of it right at the outset: address book, stored mail, and all that data if it lists other sites password backups.

...Crap. I'm going to go delete all my email which have stored passwords now.

[naff]

Scary, I'd rather my bank account was hacked over my email (no savings) and it's why I'm super safe with my info and have complex long passwords for it. Although I only didn't do this until after I logged in one day to a notice that there had been strange activity on my account recently. Guess I learned the easy way.

Did she have info on how to reset the accounts recovery options stored in an email on her account? That kinda defeats the purpose of setting up the recovery system in the first place If I was her I'd be making sure I emailed as many of my contacts as possible explaining the situation and making sure they didn't fall victim to the scam.

[chronovore]

Oh, for sure she is. She logged on to her Yahoo account and did her best. But she lived on her Hotmail account, so her Yahoo account doesn't even have all the email addresses that her Hotmail one does.

I talked to her tonight to get more information to continue processing it with Windows Live support for her, and found out that she'd been phished. A mail from MSN.com arrived, telling that her account was going to be deleted if she wasn't using it, but if she wanted to keep it just follow this link and log in... 

I don't think she'd left her password information in her account; I was just realizing about my own habits, that I've got a couple of registration mails in some of my webmail accounts, and that if any of them were compromised, those mails would also allow them to compromise those other web presences.

So anyway they're reviewing the case with additional information now. Hopefully they'll reset it and send it to her Yahoo account.

[Dickie Dee]

I like my passwords simple and lazy

Some program was being especially pushy about making me come up with a good one and told me mine is one of top ten passwords used - time to crack <1min. I'm in too deep to change it now.

 :'(

[tehjaybo]

I like my passwords simple and lazy

Some program was being especially pushy about making me come up with a good one and told me mine is one of top ten passwords used - time to crack <1min. I'm in too deep to change it now.

 :'(

brb testing a list of commonly used passwords

[Brehvolution]

 

[Dickie Dee]

doo eeet, it'd be funny

hint 1: it's not "password"