Legit? Email from EA

[LdyHawke]

I received an email this morning, supposedly from EA customer service, giving me a list of the accounts I have associated with that email address. Their message was this:

Hello,

As you requested, here are the member name(s) associated with the email you provided.

First of all, I didn't request this information, so does that mean that someone's trying to hack my accounts? Has anyone else received (or requested and received) this kind of an email? It had my account names right, but it was disconcerting, to say the least, to have them just listed like that in an email that I supposedly requested.

Any ideas? How concerned should I be?

 

[R Traveler]

have you applied for beta using insecure form?

 

[Otis Firefly]

i would definitly be concnerned and begin changing your passwords starting with your email

 

[LdyHawke]

No, I haven't even signed up for beta.

I just went to the Accounts page and noticed when you try to "Modify Account" and you click "Forgot Username", it asks you to enter your email address so they can send you a list of accounts attached to that email. Obviously, I have not done this, but I imagine someone did. The email was sent only 3 hours ago, so with any luck, nothing will happen.

 

[R Traveler]

that happened once for me 3-4 years ago, I quickly changed email and all passwords.

 

[Hobo Sapien]

No, I haven't even signed up for beta.

I just went to the Accounts page and noticed when you try to "Modify Account" and you click "Forgot Username", it asks you to enter your email address so they can send you a list of accounts attached to that email. Obviously, I have not done this, but I imagine someone did. The email was sent only 3 hours ago, so with any luck, nothing will happen.

If it were me I would not rely on luck. I would change my e-mail addy first on all accounts then change p-words.

 

[LdyHawke]

Sorry, I didn't mean I won't do anything and just rely on luck. I'm in the process of changing all passwords now. I just meant that hopefully no damage has been done. Everything on my accounts seems fine, but I'm still very concerned.

 

[Mani]

You should make sure that the email you use for your accounts isn't the same one you use on forums or other public places.

 

[DevilsOwn]

No, I haven't even signed up for beta.

I just went to the Accounts page and noticed when you try to "Modify Account" and you click "Forgot Username", it asks you to enter your email address so they can send you a list of accounts attached to that email. Obviously, I have not done this, but I imagine someone did. The email was sent only 3 hours ago, so with any luck, nothing will happen.

I'm not understanding this part.... why, when there is an email attached to the account, would it ask for one to send the information to?

~edit~ nm, reading comprehension just kicked in

 

[Hanna]

I'm not understanding this part.... why, when there is an email attached to the account, would it ask for one to send the information to?

~edit~ nm, reading comprehension just kicked in

Because they asked for account names, not passwords. email is th only other way to identify the account.

 

[GarthGrey]

To the OP, someone knows your email address. They simply clicked on, "Forgot your account name", input an email address, and EA sent them every account name associated with that email. So the bottom line is, someone knows your email address, but didnt change your password to it, because either they don't know it, or they submitted the request prior to changing it.

 

[LdyHawke]

Yeah, I pretty much came to the same conclusion. What's bothering me is that while I use that particular email for other things, I don't use it for other UO-related things, although maybe I did back in the day.

Either way, I've created a new email account to have my uo accounts attached to, changed all my passwords, and double-checked my Friends and Co-Owners lists on my houses. The tedious part is that I used to have quite a large number of accounts, having taken over some friends' accounts when they quit, so even though those accounts are no longer active, I went through the same info-change process with them, just to be safe.

 

[Wenchkin]

If you can, have different email addresses for each of your accounts and don't use those email addresses anywhere else.

If you haven't already, I'd run a full virus/spyware scan to be on the safe side.

The extra security questions you can set on your UO account are another good idea.

Wenchy

 

[Grumm]

Note to bogus email adress and forward it to EA/ Mythic. I used the unsecured site to sign up and had no problems. When I was selected for beta, my acount info was not requested until I was on a secure offical UO site.

EA/ Mythic has stated several times they will not ask for your info via email. If you are ever asked to send your account information by email, it is a scam. They don't need you to send them that information since they already have it.

 

[MalagAste]

I would say get yourself to the uo.com website.... make yourself a new email ASAP and go to uo.com change all your accounts over to the new email and change all your passwords....

One thing I do know is that hackers typically get your accounts not by going to uo.com.... but by hacking into your email... all they need to know is your account name and email.....

It's very good policy to never ever use your email that you use for your accounts for anything but your accounts.

Use other emails for websites and anything else.... even at EA when you do things there you don't have to use that email that you have listed on your account...

It's good practice to stay safe... also change your passwords often.... don't use things that are easy like your phone# your pets name your childrens names.... birthdates.... use random stuff with a mixture of letters and numbers.

But defiantly get a new email... and change those ASAP

 

[Demonous]

i would change the emails associated with the accounts and change accounts passwords, i have been hacked before and did get that exact email, along with a few that said "as requested, your password has been changed for the account so and so." That email that u received means that they know your email address and possibly email password and want to know all the account names associated with it

 

[LdyHawke]

Thanks, everyone, for all the replies. So far, my accounts are intact and everything seems fine. I've created a new email account and liked my accounts to it, changed all my account passwords, and changed the password on my original email account. Hopefully, that should take care of it. Such a great way to spend my Sunday morning.

 

[christy1221]

Thanks, everyone, for all the replies. So far, my accounts are intact and everything seems fine. I've created a new email account and liked my accounts to it, changed all my account passwords, and changed the password on my original email account. Hopefully, that should take care of it. Such a great way to spend my Sunday morning.

I doubt you did but did you happen to request your username from pogo. It will also send you all your uo accounts when you do.

 

[CatLord]

Dont forget to Activate the security Question...

http://www.uoforums.com/uo-faqs/57366-ultima-online-account-security-challenge-question.html

 

[Demonous]

Thanks, everyone, for all the replies. So far, my accounts are intact and everything seems fine. I've created a new email account and liked my accounts to it, changed all my account passwords, and changed the password on my original email account. Hopefully, that should take care of it. Such a great way to spend my Sunday morning.

those are good steps to prevention, also download spybot or some program to detect any key loggers that may have been placed on your comp... one of those damn things got me and got into multiple accounts cause of it

 

[Chrissay_]

I received an email this morning, supposedly from EA customer service, giving me a list of the accounts I have associated with that email address. Their message was this:

Hello,

As you requested, here are the member name(s) associated with the email you provided.

First of all, I didn't request this information, so does that mean that someone's trying to hack my accounts? Has anyone else received (or requested and received) this kind of an email? It had my account names right, but it was disconcerting, to say the least, to have them just listed like that in an email that I supposedly requested.

Any ideas? How concerned should I be?

Electronic Arts would never ask questions like these or ask for your password. Do not reply to this email.

 

[wee papa smurf]

Sounds dodgy to me!! If i got that email i would change everything lol

 

[EnigmaMaitreya]

My 2cp's ....

I have seen all of this spread across several replies ...

The e-mail COULD be the results of someone guessing your ACCOUNT NAME and not having a clue about ACCOUNT PASSWORDS and perhaps hoped that the email would come to them. This sounds kind of funny as I would ASSUME that the person GUESSED your e-mail account as well. So if this were real, then you might back track and try to think how someone could come up with your UO Account Name AND e-mail. If both are pretty easy to guess ... well then you may want to consider getting a NOT so obvious e-mail address.

Regardless changing passwords at this time on the UO Accounts is called for, change them ALL and then redo it every 30 days for the next 6 months. You have been targeted (possibly).

Second point as Chrisy said DO NOT UNDER ANY CIRCUMSTANCE REPLY TO THE e-mail you received, DO NOT click any hyperlinks or anything in the e-mail. DO NOT enable anything about the e-mail.

In your e-mail client, create a Folder labeled Untrusted email or some such and move the e-mail to that folder, for posterity in case anyone from UO or EA may want to look at it. Eventually you can move it to the trash folder for deletion.

 

[Chrissay_]

Remember EA will NEVER ask you for your password and would NEVER ask for any account information through an email like this one.

Chrissay

 

[Sergul'zan_SP]

As long as the e-mail came to you, there is no problem. This means somebody requested accounts associated with your e-mail address from the website. It could be that they mistyped theirs, or somebody goofing around thinking they might one day be a quality hacker.

Either way...I doubt you have anything to be concerned with. That said, it's never a bad idea to change your passwords periodically...

 

[EnigmaMaitreya]

As long as the e-mail came to you, there is no problem. This means somebody requested accounts associated with your e-mail address from the website. It could be that they mistyped theirs, or somebody goofing around thinking they might one day be a quality hacker.

Either way...I doubt you have anything to be concerned with. That said, it's never a bad idea to change your passwords periodically...

The problem I see here is this ...

The email is either Legit (as in it really did come from EA and this is the worse case scenario) or it is a phishing exercise (as in a fake, the best case scenario).

If it is a fake then a NON RESPONSE should send them on their way.

If it is a legitimate EA e-mail then what is scary here and why this should be taken seriously is that some one was able to supply 2 out of 3 security items. The UO Account ID AND the e-mail address associated with that UO account ID. I do believe the OP supplied additional information stating (what has been my experience as well) that the web site ask for the security item e-mail address associated with the Account ID. IF it matches what is on file then they send the information, if it does not then nothing happens.

That is what tells me this needs to be taken seriously, IF the e-mail is legit, then the person has 2/3 of the answer already. It is easy enough to push this back to 1/3 of the answer by creating a not so obvious e-mail address and associate it with the account(s).

 

[Flutter]

Remember EA will NEVER ask you for your password and would NEVER ask for any account information through an email like this one.

Chrissay

The email he got didn't ask for anything, it just sent him all the account names associated with the email.
Poor policy if you ask me. It only helps hackers to get more accounts.

 

[Chrissay_]

I've sent them a pm to request the actual copy email so hopefully we can research this better on our end.

Chrissay

 

[Magdalene]

I've sent them a pm to request the actual copy email so hopefully we can research this better on our end.

Chrissay

Therefore, good people of UHall, please stop speculating...

 

[Sergul'zan_SP]

If it is a legitimate EA e-mail then what is scary here and why this should be taken seriously is that some one was able to supply 2 out of 3 security items. The UO Account ID AND the e-mail address associated with that UO account ID.

Not true. Go to the UO website -> Account Management -> Edit Account and click "I forgot my username". You then only have to put your e-mail account in to have the username e-mailed to you. They only supplied the e-mail.

 

[EnigmaMaitreya]

Not true. Go to the UO website -> Account Management -> Edit Account and click "I forgot my username". You then only have to put your e-mail account in to have the username e-mailed to you. They only supplied the e-mail.

I am not going to do that, have you done it and received essentially the same mail? As in a list of accounts associated with that e-mail?

I have no interest in getting into a pissing contest when it comes down to someones security. If some one has my e-mail address and is using it to acquire additional information, then I take this very seriously. Remedy one, I change my e-mail to a not so obvious e-mail and I NEVER use that e-mail except (in context) UO Accounts.

If EA is handing out Account ID's based on a supplied e-mail, well then they need to consider the security impact of such an action. I can see then doing this IF more than one security item is supplied. I am less able to see them doing it based on a single security item being supplied.

 

[Hinotori]

As many others have said, that is the email you get when someone puts in you're email address in the forgot username field. We've been complaining about that for ages.

 

[Wallenstein]

The best thing you can do is create an email account specifically for your UO account... and do NOT use it for anything else or give it to anybody.

I have an email for my UO account only and it's a bunch of jumbled characters (i.e. [email protected] to make it virtually impossible for someone to hack my account via the "Forgot Password" or email options on http://www.ultima-registration.com.

Never use your common email address(es) for your UO account.

 

[The Home Guild]

Someone used forgot password and used your email addy that is linked to your uo acct thus giving you a list of accts with that email address. If i were you i'd change the email addy.

 

[Tinsil]

Wow. Someone deleted my other post in this thread? No idea why..

Okay what I said in it was that I've received this email a few times when I didn't request it and everything turned out okay.

I wouldn't worry. You're fine.

 

[Chrissay_]

Ok I wanted to update you all with the status of this. Yes it was an EA using the "account recovery" system. A couple things you can do to secure yourself against this is:

• update each account with a different email address
• update your email and account passwords regularly

I have it on my task list but I'm going to add an account security section in the playguide. However, Pogo does do a good job of explaining high security passwords which can be found here.

 

[Endrik]

Ok I wanted to update you all with the status of this. Yes it was an EA using the "account recovery" system. A couple things you can do to secure yourself against this is:

• update each account with a different email address
• update your email and account passwords regularly

I have it on my task list but I'm going to add an account security section in the playguide. However, Pogo does do a good job of explaining high security passwords which can be found here.

Chrissay, Thanks for your concern on this topic. One thing we could really use is a "User Friendly" Security Question system. The one in place now is extremely confusing and counter-intuitive. We need simple, clear place to set on up... For example: Log into your account info area at UO.com ad have an extra tab that says security. In that tab have place to set up or change security question. That way its easy and clear for new and old users alike as to how to use this feature.

Thanks again for the attention your giving to this situation.

 

[DevilsOwn]

standardized questions are somewhat concerning to me, also... rather than 'select from this list' I would like to create my own question.... my memory has *never* been the best and lately it's totally unreliable (hush Uriah) and my favorite pet some days is my old dog (dead nearly 20 years now) and some days it's the current cat

if I could create my own question I would be sure to create one that wouldn't confuse me

 

[Beastmaster]

Yes it was an EA using the "account recovery" system.

Chrissay please read that sentence a few times, then rewrite it to tell us what you meant to say.

 

[Chrissay_]

There's a way to recover your account name if you have forgotten it which is called the account recovery system.

 

[Tinsil]

I don't mean to try to be mean, but I assume you already knew that right?

 

[Beastmaster]

I don't mean to try to be mean, but I assume you already knew that right?

Assuming you mean me Tinsil, yes I already know there is an account recovery system. What I still don't know is exactly what Chrissay was trying to say.

Since the sentence didn't make sense, you have to modify it based on some sort of assumption. Maybe this:

Yes it was an EA employee using the "account recovery" system.

or this:

Yes it was an EA email from the "account recovery" system.

or this:

Yes it was someone attempting to hack your account using the "account recovery" system.

Maybe she'll reread her sentence a few times now and make it coherent.

 

[Tinsil]

I was actually talking to Chrissay. It kinda sounded like she wasn't aware there was such a thing. Maybe I read it wrong.

 

[Flutter]

There's a way to recover your account name if you have forgotten it which is called the account recovery system.

That's kinda what the folks here have been trying to tell you. We don't WANT all our account names available with one click. You should have to at least call support to have that kind of information sent to you.

 

[MalagAste]

That's kinda what the folks here have been trying to tell you. We don't WANT all our account names available with one click. You should have to at least call support to have that kind of information sent to you.

Call support, yes. Would prefer if there were 3 or so questions and some sort of one of those type what's in the box questions, before I even get the email. Put the kabash on folk hacking accounts through E-Mail... which is horrible.

 

[Warrior of Time]

Set up a new account with Pogo
It will return to your e-mail box a list of your current accounts with EA. It will also check for gaming black marks.

It told me about 4 accounts I had with UO years ago.

Also changing the e-mail address to work with the one account you have with UO can leave you with a very long list of e-mail addresses.

I had changed nothing and had no invite to UO/SA. If I did how many would I have to check. More than one email per EA account is not a good idea.

Pogo goes by the isp.

Please check and prove me wrong.

As I see it you just set up a new account name, password, and the same E-mail with Pogo.

 

[LdyHawke]

I don't have a Pogo account. I haven't signed up for anything, game-related or not in quite some time, and prior to this whole thing, I hadn't visited the Account Management page in at least a couple months, so I really don't think there's anything I did to trigger this.

That said, if EA could track the isp of the person who requested the account info, that would obviously help solve the mystery, but since no harm has been done (as of yet *crosses fingers it stays that way*), I don't see that happening.

Thanks to all for their investigative work.

 

[Warrior of Time]

I have gotten un requested things like that before during the last almost 12 years. (142 months.) Anything like that is always sent to the e-mail listed with whatever that account is matched with by EA. That always gave me a chance to change the passwords to all my accounts. With the need to answer the question I have never received one that they have actually gotten the password. The password is also sent to the listed account e-mail. You got it because it although it was requested, was sent to you. Not another e-mail address.

I would consider you change the password if you think they got it through Your e-mail address.