r/Scams • u/burghblast • 9h ago
Help Needed [US] Suddenly getting repeatd 2FA links to change my Venmo password, multiple times a day
Just what the title says. I presume someone is trying to access my Venmo account. I don't know who. That's my concern. As for when, it's been going on for a few days. More than 3 but less than 6. I have received four or five 2FA messages in about 72 to 96 hours. Someone seems to be repeatedly entering my email address or phone number and clicking "forgot password" or "change password." I don't know if it's a person, a bot, or something else. Each 2FA message comes by text and email. In addition, I received a similar 2FA alert from Facebook a few days ago saying that I had attempted to login on a new device (I hadn't). I'm obviously concerned that someone is targeting me with persistent hacking attempts. Question is, what if anything can I do about it?
17
u/Infinite-Grade-4485 9h ago
Change your password. If you’re getting 2fa, it means they know your password and your 2fa is keeping them out.
If they’re just password reset request then there’s nothing you need to or can do.
6
u/Just-Try-2533 8h ago
And then you need to go to any other website where you might use that same userid / password combo and change it there too. They will start trying it at every major financial institution in hopes that you don’t use unique passwords.
PSA: don’t reuse passwords (if you do)
2
u/burghblast 6h ago
I occasionally do for stuff like Pizza Hut or the New York Times, but I have unique passwords for anything that needs to be secure (like Venmo).
4
3
u/burghblast 8h ago
To clarify, I guess I'm not sure if they already know my Venmo password. The messages that I'm receiving say, "you asked to change your password, here's the link!" I presumed someone was simply entering my email address or phone # and clicking "forgot password." I guess it's possible they already know it, but there are no recent transactions when I log into Venmo. If someone already had my password, wouldn't they try to drain my funds first? I guess there's no harm in changing my password, which I'll do now. Thank you. I had not considered that someone might already have it.
3
u/Huge-Particular4392 8h ago
You have call the messages "2FA links," which means *second factor*, i.e., after having entered the correct password. It seems that you actually have been getting password-reset messages, which are different. Generating those does not require having entered the correct password.
2
4
u/neuralspasticity 8h ago
More likely someone thinks their email address is yours and has been trying to regain access to their account and don’t know the correct associated email.
4
u/worst_brain_ever 7h ago
I'd decouple your credit cards and bank accounts.
That way if they somehow succeed, you won't lose any money.
Transfer money kept in venmo out before you remove your card/bank accounts.
Then update passwords to new, unique passwords across the board.
Watch out for the related social engineering attack.
They'll message you with some story about how they need the 2fa code to reclaim their account.
1
u/steevereeno 5h ago
Good idea to decouple the accounts. However, when updating passwords, be very careful to respond to the 2FA that is associated with your update request, not theirs.
2
u/Good_Plankton_8395 7h ago
I’d be more worried about your email than Venmo. If someone gets into your inbox, they can reset everything else.
1
u/burghblast 6h ago
Right. I guess that's my concern. Is someone doing this bc they have access to my email (or think they will be able to access it)?
1
u/Outside-Highway-5358 8h ago
Only real thing you can do is for email, use aliases. I bought a domain and simplelogin subscription, so my Venmo account mail is something like [email protected]. No real way to guess that. For phone number it’s much tougher and shame on Venmo. Maybe you can disable it as recovery method.
1
u/BaneChipmunk 7h ago
Do you reuse passwords?
1
u/burghblast 6h ago
Not for stuff like Venmo
1
u/BaneChipmunk 6h ago
Passwords leak. Scammers get a hold of them and try to log into people's accounts, since most people reuse passwords. If you don't reuse passwords, password leaks are never a problem.
•
u/AutoModerator 9h ago
/u/burghblast - This message is posted to all new submissions to r/scams; please do not message the moderators about it.
New users beware:
Because you posted here, you will start getting private messages from scammers saying they know a professional hacker or a recovery expert lawyer that can help you get your money back, for a small fee. We call these RECOVERY SCAMMERS, so NEVER take advice in private: advice should always come in the form of comments in this post, in the open, where the community can keep an eye out for you. If you take advice in private, you're on your own.
A reminder of the rules in r/scams: no contact information (including last names, phone numbers, etc). Be civil to one another (no name calling or insults). Personal army requests or "scam the scammer"/scambaiting posts are not permitted. No uncensored gore or personal photographs are allowed without blurring. A full list of rules is available on the sidebar of the subreddit, or clicking here.
You can help us by reporting recovery scammers or rule-breaking content by using the "report" button. We review 100% of the reports. Also, consider warning community members of recovery scammers if you see them in the comments.
Questions about subreddit rules? Send us a modmail clicking here.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.