iTunes unauthorized transaction

Discussion in 'Yosemite (10.10)' started by xthine, Jun 14, 2011.

  1. xthine

    xthine PhilMUG Addict Member

    Joined:
    Oct 16, 2005
    Messages:
    1,480
    Likes Received:
    340
    Gender:
    Female
    Location:
    Red Rock Country
    Has anybody ever had this happen?

    I woke up this morning with several emails from Paypal and my credit cards alerting me about possible fraudulent activity..lo and behold someone managed to purchase several apps (with in app purchases) using my iTunes account. I am now sure how it happened, I used my MBA, HP and iPad2 to access iTunes and sign in to my account over the weekend.

    [​IMG]

    That's the initial irregular activity, there were 5 subsequent unauthorized purchases after that. I've emailed iTunes CS, they told me to inform of course Paypal and my CCs which I already did.


    Dear Christhine,

    It's Joginder again. Thanks you for writing back to me.

    I am sorry, I will not be able to immediately resolve this issue for you, however as a customer support I will do my best to provide you the adequate information.

    Christhine, dealing with unauthorized purchases is not something Apple takes lightly. I'm sorry that I can't resolve this for you myself, but under the circumstances the iTunes Store can't reverse the charges for those purchases without chargeback orders from your credit card issuer.

    Please ask your PayPal card issuer to cancel the card, investigate the security of your account, and send chargeback orders to the iTunes Store. Your card issuer will directly contact us with chargeback orders in order for you to be reimbursed for the charges.

    If you need further assistance regarding this issue, please contact your legal advisor, who may contact Apple's litigation department http://www.apple.com/legal/contacts.html on your behalf.

    I believe that the above information will help you resolve the issue. I am sorry again that I have not been of much help to you. If you have any more questions about this, please don't hesitate to let me know.

    Sincerely,

    Joginder
    iTunes Store Customer Support



    Can't help but feel but violated. And I cannot understand how someone could blow hundreds of dollars on this "gangsta" game. :redface:
     
  2. vgsison

    vgsison Well-Known Member

    Joined:
    May 7, 2009
    Messages:
    1,133
    Likes Received:
    28
    Scary. I hope u can resolve this the soonest.
     
  3. mystavros

    mystavros Member

    Joined:
    Jun 24, 2009
    Messages:
    760
    Likes Received:
    3
  4. xthine

    xthine PhilMUG Addict Member

    Joined:
    Oct 16, 2005
    Messages:
    1,480
    Likes Received:
    340
    Gender:
    Female
    Location:
    Red Rock Country
    ^Thanks, Mods please merge threads.

    @vgsison - Thank you. I hope so too. Paypal seemed sympathetic and they told me it would take up to 10 days for the charges to be taken off. I could not get a hold of a live CS agent for iTunes though.
     
  5. raypin

    raypin PhilMUG Addict Member

    Joined:
    Jun 8, 2008
    Messages:
    12,698
    Likes Received:
    5,440
    mmmm.....so this is the first confirmed case of a Philmugger losing real money from a hacked iTunes account. If I understood what happened, you downloaded a free app called Original Gangstaz and the perp used your credit card info (on file with Apple, Inc.) to make the unauthorized purchase. If so, that's something very serious. Scammers masquerade themselves as developers then submit their App to the Appstore. After which, the Scammers lure unsuspecting iTunes users to download their app with a free-to-try offer. After gaining access to your credit card info, they use it to make the unauthorized purchase. Now that is a ridiculous situation. No more backdoor. Just use the front door because it's wide open.
     
  6. xthine

    xthine PhilMUG Addict Member

    Joined:
    Oct 16, 2005
    Messages:
    1,480
    Likes Received:
    340
    Gender:
    Female
    Location:
    Red Rock Country
    ^No I never downloaded the free app in question. Come to think of it, looking at the list the Gangstaz game seems so out of place/'uncharacteristic'. It looks like it happened after I updated the apps, I don't know.
     
  7. lesterjune

    lesterjune Member

    Joined:
    Jul 2, 2008
    Messages:
    838
    Likes Received:
    12
    Location:
    Makati
    You may need to change the password of your iTunes account also. Use a strong password. For every attempt to purchase either in Mac or iPad, iTunes always prompts the user to enter his password.
     
  8. raypin

    raypin PhilMUG Addict Member

    Joined:
    Jun 8, 2008
    Messages:
    12,698
    Likes Received:
    5,440
    @xthine....some questions:

    1. If you did not download the free app and subsequent purchased version of the Ganstaz app, are you saying that the questionable app is not in your device(s)? It does not appear?

    2. Before and after the questionable transaction(s), did you experience any difficulty accessing your iTunes account? Is your iTunes password still the same?

    3. Did you lend your device(s) to anyone? Are any of your device(s) being shared? Did someone else use it?

    4. Did you disclose your iTunes account info (username and password) to anyone in the past?

    5. Have you ever left your devices the device(s) unattended while iTunes was running in your device(s)?
     
    #8 raypin, Jun 14, 2011
    Last edited: Jun 14, 2011
  9. xthine

    xthine PhilMUG Addict Member

    Joined:
    Oct 16, 2005
    Messages:
    1,480
    Likes Received:
    340
    Gender:
    Female
    Location:
    Red Rock Country
    @lesterjune - Yes i changed my iTunes account password. Also changed passwords for Paypal, emails, credit cards and bank. A part of me wonders well, since I used my iPad2 and when iTunes prompted me for my password the letters are visible, could that have been the culprit? I haven't figured out how to change that. I noticed that when i'm on my computers browsing the letters are not revealed (briefly) as I type my password.

    @raypin:

    1) I did not purchase the app in question and upon further review it appears that it's an iPhone app. I don't have an iPhone. My husband does but he does not know of that game (Original Gangstaz) nor does he express any remote interest in it. I downloaded the new iTunes (10.3) yesterday and now I can see my purchases and sure enough the app in questions was there. When I click on the iCloud icon though it tells me that my iTunes account was suspended/deactivated. Apparently a quick google search shows that there are a number of these iTunes unauthorized purchases esp. with iTunes giftcards and with other accounts that use Paypal.

    https://discussions.apple.com/thread/2661724?threadID=2661724&tstart=74

    https://discussions.apple.com/message/15364613

    2) Yes i did have problems accessing iTunes, I think a few days prior, my iTunes account led me to iForgot. I did not make a big deal of it then and thought it was a glitch. I've changed my iTunes account password and now log out of it when i close iTunes. No problems accessing my iTunes account immediately after the fraudulent activity.

    3) Nobody except my husband, and he only checks his weather app stuff. The only game he likes to play is a lawnmower game and Angry Birds. :)

    4) No i've never disclosed my iTunes account info to anyone. I mentioned above about the possibly that someone could have "hacked into" my iPad2 while I was using it, called Apple about it and they said there was no way that could happen and no there's no security app for the iPad2.

    5) I've left my device unattended here at home, but nobody else is around and we always make sure we lock the door when we leave.

    Those are very good questions, Apple did not ask me those questions specifically (just the password issue).
     
  10. p.pipster

    p.pipster PhilMUG Addict Member

    Joined:
    Mar 3, 2008
    Messages:
    1,310
    Likes Received:
    340
    Gender:
    Male
    Location:
    Cebu
    This is the more serious stuff that the press should be looking at. Instead of that ridiculous "antennagate" and "location-gate".
     
  11. ratburn

    ratburn Member

    Joined:
    May 16, 2005
    Messages:
    309
    Likes Received:
    11
    a little bit OT, i can not believe there is an iphone app that costs a hundred dollars!!

    a few years back, i got shocked that my itunes credit was almost 20 dollars below the amount that i know. i thought my account got hacked, told my brother about it and he said he used my account! arggh!
     
  12. raypin

    raypin PhilMUG Addict Member

    Joined:
    Jun 8, 2008
    Messages:
    12,698
    Likes Received:
    5,440
    @xthine.....pardon the intrusive questions but this subject matter is (I feel) a matter of great interest to the community since most of us here have iTunes account.

    Let me see:

    1. You purchased some apps with an iTunes gift card via Paypal. Said iTunes gift card was apparently fraudulent (it is a well-known problem that some ebay vendors sell IGCs that were purchased with stolen credit card info).

    2. You redeemed the code.

    3. With the fraudulent IGC now linked to your account, someone made unauthorized App purchases and cleaned out your account (this is new to me).

    Did I get the story right?

    If so, wow.......I admire the people behind the scheme. First, they use stolen credit card info to purchase IGCs. Then, they resell it to unsuspecting buyers through the internet. After the code was redeemed, they somehow managed to make unauthorized purchases using your account. How? The app in question is the key or it could be another app (probably one of those free apps that you've knowingly downloaded. By downloading the free app, they somehow managed to gain control over your iTunes account and purchased the US99.99 app. In short, ginisa ka sa sariling mantika.

    If the theory is correct, it is a classic trojan horse.

    Nice.
     
    #12 raypin, Jun 14, 2011
    Last edited: Jun 14, 2011
  13. xthine

    xthine PhilMUG Addict Member

    Joined:
    Oct 16, 2005
    Messages:
    1,480
    Likes Received:
    340
    Gender:
    Female
    Location:
    Red Rock Country
    @ratburn: The game is free, it's the in app purchases that evidently could result in exhorbitant charges. See below. They bought "street credits" which I guess is required to play the game.

    [​IMG]



    @raypin - No it's alright I don't mind the inquiries at all.

    1) I did not use iTunes gift cards, makes me wish I did so they couldn't have wiped me out as bad. The default payment method was Paypal and my Paypal account was linked to 2 of my credit cards. Whats odd is how did they even get to choose which card to use for the purchases? Thank goodness they did not attempt to use the 3rd credit card linked to my Paypal account.

    2) No codes redeemed.

    3) I didn't use an iTunes Gift card. Actually now what I'm thinking is just buy these gift cards in 20 dollar denominations so that if it gets hacked again I won't be charged much. :(


    I never downloaded the free original app in question.. which is weird. Somehow it found it's way into my iTunes purchased list and from then on my account got charged for the in-app purchases (in this case street credits). It's supposed to be an iPhone game (Original Gangstaz) and I do not even use an iPhone. The only apps I download using my iTunes account are iPad apps.:slanted:

    Apple support update: I emailed them yesterday that I informed Paypal and my credit card institutions about these fraudulent transactions. I asked them if there was anything else I could do to help facilitate the investigation process. No replies today. :rolleyes:
     
  14. zoo101

    zoo101 Well-Known Member

    Joined:
    Jul 6, 2006
    Messages:
    1,344
    Likes Received:
    144
    Location:
    Sikatuna Village, QC
    @xthine
    how much was the total unauthorized purchases? just curious
     
  15. xthine

    xthine PhilMUG Addict Member

    Joined:
    Oct 16, 2005
    Messages:
    1,480
    Likes Received:
    340
    Gender:
    Female
    Location:
    Red Rock Country
    ^Around 400USD.
     
  16. greta87

    greta87 PhilMUG Addict Member

    Joined:
    Nov 28, 2006
    Messages:
    4,455
    Likes Received:
    1,335
    Gender:
    Male
    Location:
    Makati
    I hope this gets resolved soon. I'm also keen in finding out what iTunes store & paypal does with your case. & how the scam was pulled off.
    I usually get gift cards from the US & just have these redeemed.

    Sent from my iPhone using Tapatalk
     
  17. raypin

    raypin PhilMUG Addict Member

    Joined:
    Jun 8, 2008
    Messages:
    12,698
    Likes Received:
    5,440
    @xthine......

    So, the theory now is:

    The fradulent transactions did not originate from any of your devices since only you and your hubby had access to it and we can discount sidejacking since access to iTunes is over an encrypted "line" (SSL). That only leaves two possibilities: the fraud originated from Apple's iTunes servers (where all of the crucial data is stored) or it originated from the app developers (by downloading free apps from them, it is possible that developers somehow gain access to your iTunes account info).

    I'm leaning towards the first possibility. Your account info was stolen from Apple's iTunes server. Since last year, there had been reports of thousands of compromised iTunes account being sold by shady operators in mainland China and said compromised iTunes account could only be stolen from one place. From what I can remember of their modus operandi: the accounts are sold for as little as 10 yuan and the buyer had to use it within a few hours after purchase.

    I've posted about this in another thread, last year. USD400.00?!?! God, that's an awful lot :(

    Silver lining: it's a good thing you linked your credit card info with Paypal. By default, Paypal does not disclose to vendors your credit card numbers (including the all-too important 3 digit code). Otherwise, the perps would have a field day purchasing not just apps but a vacation in Hawaii.

    Slight ot: This made me think of the possibility of vendors requiring biometrics, instead of passwords or passkeys, for buyers to make purchases. It is far more secure. I use biometrics on my desktop machine (for log-in) and face reccognition on my laptop (and the drives are encrypted (Truecrypt) and password-protected to prevent unauthorized access).
     
    #17 raypin, Jun 15, 2011
    Last edited: Jun 15, 2011
  18. lamski

    lamski PhilMUG Addict Member

    Joined:
    May 8, 2005
    Messages:
    2,633
    Likes Received:
    296
    Location:
    Makati, Philippines
    Regarding security, on my first mac, I enabled filevault on my home folder. It was a bit of a pain during shutdown because filevault does some cleanup to reclaim storage space. Backup applications like carbon copy cloner also took a long time since it backed up the encrypted sparse image of the filevaulted home folder as well as the opened folder.

    So on my next mac, I did not enable filevault but I created encrypted sparse images for my sensitive files. I eventually bought Knox (on sale when it joined agilebits - the makers of 1Password) for easier management of encrypted disk images.
     
    #18 lamski, Jun 15, 2011
    Last edited: Jun 15, 2011
  19. bugs

    bugs PhilMUG Addict Member

    Joined:
    Jul 3, 2007
    Messages:
    3,155
    Likes Received:
    602

    wow! $400?!! i hope itunes/paypal resolves it soon. i think i better just load my account with small denominations ($10) at a time. at least if my account gets hacked, he would be using $10 max only.
     
  20. lylesantos

    lylesantos Member

    Joined:
    Dec 19, 2007
    Messages:
    312
    Likes Received:
    0
    Location:
    Davao City
    Here's a theory:

    Some people use the same username and password combination for all their accounts. Example:

    E-mail: pilosopongtasyo@yahoo.com
    Password: birthday123

    iTunes ID: pilosopongtasyo@yahoo.com
    iTunes PW: birthday123

    Facebook Login: pilosopongtasyo@yahoo.com
    Facebook Password: birthday123

    Paypal Login: pilosopongtasyo@yahoo.com
    Paypal Password: birthday123

    So, if a perp gains access to one account, say an e-mail login credential, he essentially has access to all other accounts having the same username/password combination.

    Are your accounts setup like this? I hope not.
     

Share This Page

  • About PhilMUG

    Since the mid-1990s, PhilMUG (formerly the Philippine Macintosh Users Group) has grown to become not just the Philippines’ but one of the world’s foremost Apple user groups. Our online community brings together thousands of members from the Philippines and around the world for the latest news and discussions covering all Apple products and related hardware and software. Anyone can join PhilMUG, from newbies to experts, subject to our membership rules and guidelines.
  • Like us on Facebook

  • Buy us a beer!

    The staff works very hard to make sure that PhilMUG is running 24/7. Care to buy us a beer or help out with our hosting fees? We'd really appreciate it!

    Donate to us!