My VOIP phone account has been hacked

[yello]

Earlier today, I received an 'account funds low' message from my VOIP account. Strange I thought, but a look at the account history revealed £200s worth of calls to Bosnian mobiles in the last 36 hours!

I've changed the account password and SIP password so hopefully that'll put an end to the hacker's activities on my account but they still presumably have the credit card details. I've alerted the VOIP phone company (Sipgate)... but I had to do that by email since there is no contact phone number. The email response said they'll attempt to answer my query within 2 days!

Fortunately, my exposure to it was less than £5 as that's all I had in the account. This is the weird bit, whoever had hacked my account was using a credit card to credit the account - but not any of my credit cards (I never store my credit card details on 3rd party sites). I presume it'll be a stolen one, so some poor sod has been stung.

I feel powerless to do any more to stop the further potential fraudulent illegal use of a credit card. I just hope that whosoever card it is has an on the ball credit card company.

 

[yello]

The VOIP telco have responded... they'll credit me back the call charges as a gesture of goodwill and because they don't want to profit from malicious activity. To be honest, I didn't even think of that. It never even crossed my mind that they'd attempt to bill me for the fraudulent calls.

They had no real suggestion - beyond the obvious - as to how it could have happened but at least they did acknowledge that it wasn't necessarily my computer that had been hacked. They imply it could have been their system. I run linux behind a firewall and have malware detection on my email, so I think it unlikely that my computer was hacked. If it was, the hacker would use more than my VOIP account I presume! I changed passwords on all other financials just in case.

As a moral to the story, I'd recommend nobody keeps credit card details on 3rd party sites. There's too big a risk for negligible gain, imho. You might consider changing passwords on a regular basis but I'm not actually sure that'd be of huge benefit. Once someone's cracked a password, or hacked an account, they're probably not going to hang around before using it!

 

[snailracer]

... I'd recommend nobody keeps credit card details on 3rd party sites...

But you have no way of making an online payment without revealing CC details, then you have little option but to TRUST the 3rd party to not misuse those details.

Some banks can provide single-use CC numbers for making online payments, which should be quite secure, although I've never used it myself.

 

[yello]

The emphasis is on keeps (i.e. optionally stores) your details on the site, like some sites (Wiggle for instance) offer, so that you can use them for your next purchase.