Stealing is bad, but in this instance it’s actually OK, and I’ll explain why in a moment.
I have a really, really old Yahoo! Mail account that I originally created in 1997 (it’s only 5 letters long). While I don’t use that mail account for anything, I do periodically check it because there are a handful of instances each year that someone tries to steal the account. Yes, I could abandon the account, but it has some sentimental value to me since it’s so old and that’s why I keep it.
I have to change the account password several times a year to keep hackers from busting into it. If you’re thinking, “Well, you must use simple passwords if that’s what you have to do to keep hackers from gaining access”, no, that’s not the reason the account keeps getting almost-busted into. What happens is that hackers from foreign lands brute force their way into the Y! system by any means necessary, look for backdoors (usually in non-US Yahoo! servers), and periodically bust their way in. Or in the instances I’m about to tell you, “mostly” in.
The latest that happened with my Y! account is that someone registered an Apple ID with it. As for why they did, I have no idea. But somehow they were able to get one registered and successfully confirm it using my Y! address.
What most people would do in this instance is spam-flag anything they didn’t sign up for. That wouldn’t do me any good here because Apple obviously isn’t a spammer, so the emails would keep showing up. Setting up a filter usually doesn’t do any good either.
Instead, what I do is go to the site where the account was registered and do the “forgot password” thing. I absolutely do not click any links in the emails. If the account was legitimately registered, I will receive a new “change your password by clicking this link” email. With the Apple ID, that’s exactly what happened, so the account was legitimately registered to my Y! address.
Once the password is changed, I “steal” the account (which is not really stealing since it used my email address to begin with), change every bit of information in there, set up a ridiculously cryptic password along with ridiculously difficult challenge questions/answers. With the Apple ID, again, this is what I did.
After that, the Y! account password and challenge questions/answers were changed.
One day later, my Y! inbox had something in the neighborhood of 6 to 10 requests from Apple – made by the guy who tried to hack my account – to change the Apple ID password. Obviously, he ran straight into a brick wall there. All the security information was changed, so he never received the emails. After that he just gave up.
What you can you learn from all this?
A few things.
It is better to “steal” an account that some hacker registered using your email address instead of just letting it sit
The hacker had a reason for registering whatever account he did. As for what reason, I couldn’t say because I don’t know. But had it been left active for his use, that can ultimately lead to identity theft.
Consider this: Once you “steal” the account for yourself, your email address can’t be used to register another account at the same site again.
Flagging emails as spam and/or setting up filters is not always the answer
You can flag-flag-flag and filter-filter-filter until you’re blue in the face, but in the end this may serve to be a rather large inconvenience to you because you may flag/filter out emails you’d actually want to receive.
Changing only the password is not enough
Above you read about me changing “challenge” questions/answers; these are separate questions in order to verify your identity.
Example challenge question: “What is the name of your pet?”
Example challenge answer: “Fluffy”
The way I do challege questions and answers is that I always specify my own question, which will usually read, “it’s in the database” where I will have a cryptic over-24-character challenge answer.
If the system for whatever it is requires two questions/answers, I label those as “it’s in the database 1″ and “it’s in the database 2″, both with separate cryptic answers.
At this point you’re probably thinking, “Geez.. all that for a Yahoo! account?” Yep. This is why I’ve been able to keep my Y! account for 15 years without it having been stolen.
Change your passwords and challenge questions/answers routinely, and the chance of your account being stolen decreases a great deal.
Final note: Do all Yahoo! Mail accounts suffer this fate? No. Mine does because it’s short, 5 characters and desirable. However, what happened to my Y! account can happen to any.
The PCMech.com weekly newsletter has been running strong for over 8 years. Sign up to get tech news, updates and exclusive content - right in your inbox. Also get (several) free gifts.