Malicious attempts at logging into my accounts: what do I need to change?

[Chandler Conn]

I'm asking this on behalf of a friend, but I'll speak from the first person.

Over the past few years, I have been hit with many messages from various services about people attempting to access my account. The services are mostly gaming ones, such as steam and origin, but I have also gotten pings from my credit and bank accounts.

All of my passwords have been changed and randomly generated, and thankfully nothing bad has happened yet. A few times my accounts have actually been accessed, but thankfully they were the ones with no saved credit card information. Most of the targets are failed login attempts.

It seems that when an IP is provided it's from India or nearby. I'm just wondering why this keeps happening to me, way more than what people close to me say should happen, and what steps I need to take to prevent this from happening!

I'm thinking of changing my email address, but if this won't do anything then I'd prefer to avoid it.

Thanks!
-C

 

[rgd1101]

Do you keep you system up to date?
install/run any questionable software?
go to any questionable website?
response to any phishing attempt ?

 

[Chandler Conn]

Do you keep you system up to date?
install/run any questionable software?
go to any questionable website?
response to any phishing attempt ?

Yes, no, no, and no. This is why I am confused. I am not a computer novice, and this system is fairly new as well. I'm mostly wondering what there is for me to do to break out of this cycle so that it can't keep happening. I know there are many ways this could've started but I'm more interested in the solution at this point.

 

[rgd1101]

create new account if possible.
email account is free, create multiple one for different things.

 

[Peter Martin]

new email. use passphrases, much better and secure than passwords. always use two-step verification if possible, so google gmail supports that, etc..

 

[mdd1963]

Many spam emails that are fishing attempts are also sent indicating assorted attempts are made to 'access your account', usually with a bogus request that you 're-enter your data to verify', which is where the compromise is actually occurring....

Many fall victim, and mindlessly give away all username/longin data at such requests.

Trust no such messages/emails, unless you are CERTAIN they are legitimately coming from the service in question...

Many such emails are stupid enough to even include the phrase "It appears you account is being accessed from xxx country, etc...."

Were they legit, you would likely be unable to login any more via normal channels...

Trust no one.