PSA: Change your iTunes password.

[blurredvision]

I remember reading about some iTunes debauchery last month where some developer fraud was taking place. An article about it is here:

http://www.engadget.com/2010/07/09/itunes-fraud-takes-trip-to-travel-section/

I paid it not much attention until last night. Back in 2005, I had purchased an iPod Nano. It was my first iPod, so I created an iTunes account and linked it to my Paypal to pay for music purchases. About 8 months later, I sell the Nano. My iTunes account basically became unused at that point, as I wasn't purchasing any more music, so it lay dormant for years. Last year, when I got an iPhone, I created a new iTunes account, so the old one is still long forgotten in my mind.

Fast forward to last night, when I receive two emails for iTunes purchases on my Paypal account, one for around $40 and another for $8. I obviously immediately realize these are not my purchases, so I frantically change the password to my Paypal account and my current iTunes account. I'm assuming at this point that somebody got my Paypal login info. I disputed the two charges with Paypal, and when I got done, another $40+ charge popped up. I immediately dispute that one and start looking for Paypal's number.

Thankfully they were still open pretty late, and I talked to an account security guy who knew exactly what was going on. He said that recently, Apple incurred a massive security breach that compromised a ton of accounts. He then said that those payments were coming in from an iTunes account that had an automated billing service attached to my Paypal. I immediately recognized this as my long-forgotten iTunes account, since my new one is linked to my credit card.

So basically, someone got my old account info and began charging all kinds of stupid stuff since my Paypal was still linked up. The Paypal guy immediately canceled the link allowing purchases from that iTunes account. Before he was done, though, another $40+ charge showed up. All of the charges are currently disputed and he informed me that I should get my money back in about a week or so once they are refunded to my account (I can then deposit that back into my banking account).

All in all, I'm currently down about $135 or so, and once I finally realized it was my old iTunes account and not my new one, I logged into it and changed the password when there were 3 more purchases waiting to be charged (but obviously can't be, now).

With that said, I figured I'd share my story in case anyone would want to change their password. I'm not saying the above linked story is related, but the security professional at Paypal openly stated that they were working their asses off trying to clean up after Apple's mess, since this is a huge problem.

 

[KeithP]

Wouldn't make sense to simply not allow your payment information to be stored by iTunes?

From what I have read about these unauthorized iTunes charges, I am not convinced the breach was with Apple. I think it more likely the problem's origins are somewhere else such as malware on the users system (one example, there are other possibilities). The fact that someone at PayPal is saying that Apple/iTunes has a security breach is certainly not definitive. If fact, I would guess if you contacted Apple and told them what PayPal said there would probably be words exchanged between the two companies.

I read an article on TechCrunch done it 2009 that said 75 million iTunes accounts are linked to credit cards. If Apple had a security breach, there would be a lot more fraud.

-KeithP

 

[Kmax82]

This happened back in June.. Not sure if you're situation is connected or not.

http://thenextweb.com/apple/2010/07/04/appstore-hack-itunes/

 

[blurredvision]

From what I have read about these unauthorized iTunes charges, I am not convinced the breach was with Apple. I think it more likely the problem's origins are somewhere else such as malware on the users system (one example, there are other possibilities).

I would accept that as a possibility (I'm not an ass who can't possibly fathom a virus got by me), but I've not accessed that account for YEARS. When I logged into that old account and changed the password, I checked out the purchase history to see what crap this thief was buying. The last purchase I made on that account was in mid-2006. That's when I sold the Nano I had and bought a Creative Vision M, at which point I switched over to Napster. Three months later, I bought the Zune at launch and haven't looked back. Point being, I've not logged into that account for 4 years.

I can't honestly believe somebody had my login info from 4 years ago and only now decided to pounce on it.

 

[Kev]

I'm not following, how do you think someone got your 4-year old account info? Was it still stored on your old ipod?

 

[blurredvision]

I'm not following, how do you think someone got your 4-year old account info? Was it still stored on your old ipod?

Nah, that old iPod was wiped years ago and given to my sister-in-law. The only logical conclusion is that I was a victim of this security breach at Apple, which definitely happened. To what extent, though, I don't know.

Over the 4 transactions, there were approximately 50-60 individual purchases that literally ranged from Angry Birds to a bunch of things with nothing but Chinese characters.

 

[abaez]

I had a similar situation. I haven't had an iPod or used iTunes since my second gen iPod like.. 6 years ago?

About four months back someone somehow bought a bunch of music using my iTunes account. Nothing was up to date on it obviously, so some other CC was used. The purchases were like $50 of various cd's/music. I updated my info, changed my password and everything has been good since. But it was weird to see.

 

[akugami]

OP. Can you add this at the top of your post. You can create an iTunes account without the need for a CC# or Paypal. Just buy iTunes gift cards and enter them in your account. It's a little cumbersome but it adds protection and one less possible security breach.

1. Download and install iTunes. Be careful not to install Safari if you don't want it.
2. Browse the app store and "buy" a free app. Doesn't matter which.
3. When you do this it'll ask you to sign in or create a new account.
4. Enter the steps to create a new account. For form of payment, click none.
5. Verify and activate account.
6. Enjoy.