Account Hacked

These incidents rarely if ever end well for the victim.

Best of luck with it

They should easily know who is behind this....... the poker they were playing I bet it was heads-up with a buddy of his.....

Didn't we have a very similar post to this recently?

akajak?????????

I'm sure your right easygold, I was surprised that when I contacted Betfair it didn't seem to be treated with as much seriousness/urgency as if something similar happens with say a dodgy credit card transaction and you speak to the fraud department of a bank.
The Indian call centre said that I would hear from Betfair by email; All I can do is wait :-(

Pizzaro; Akajak yes, that's my forum name didn't understand your ?????????

IIRC the last hack here a few months back was either his money lost on US or AUS racing on which the guy never bets.

I remember a thread a few months back regarding a chap who'd had all the money in his account placed on a US Soccer match on the Sportsbook if my memory serves me right....

can't remember what/if there was any outcome of that though

Dec 1, 2017 -- 6:38PM, pizzaro wrote:

akajak?????????

Yeah I can see your why u would ??? the name....

Thank goodness, that has never happened to me as I always clear my account after a big antepost race, win or lose. I'd also contact Betfair customer service advisor through 'live chat' to show my disgust and concern, and to ensure Betfair addresses the issue immediately and thoroughly; it is so bad for their pr even though the missing fund cannot be transferred externally. Good luck!

This seems to be happening quite a lot recently.

Having an acronym of Ace King Ace Jack Ace King as a forum name may make people sceptical though. It will be very easy to prove that you don't/haven't play poker on here though.

I'm not saying for one minute that you've done this, but it would be a piece of piss to give a friend your log in details to syphon your account, (especially someone who lives a long way from you) then claim the money back.

The last hack was refunded IIRC after a lengthy check of the facts..

Been going on For years Mate had 2  bags transferred to poker , Sadly he never got it back that was about 5 years ago.

Akajak - Do you use two step authentication?

2-step authentication is a must, as is self-exclusion from Poker if you don't play.

It was my account that was hacked that Bigfield refers to i think see below if it helps http://community.betfair.com/horse_racing/go/thread/view/94102/30860069/account-g-emptied
All sorted(justifiably)in my favour in the end. I hope you ultimately get sorted as well mate

Did op have 2 stepauthentication

Yes, 2 step authentication a must now. I have also self excluded from poker, casino, exchange games, arcade, bingo, vegas and macau slots (whatever that is) etc.

2 step authentication is not available unless you have an i phone.

we've done this before sparrow

it doesnt have to be a phone, tablets access 2-step too

...and phones dont have to be apple products either

I'm just reporting what betfair has told me as I only have internet access via my laptop.

I use it via either an ipad or an android note 8

So in order to use this extra layer of security I have to buy a new gadget.

Yes in a nutshell
But its not BF's security anyway, its third part software, namely google authenticator

party

I would imagine there are quite a few users who are unable to use this for the same reasons. As a dinosaur I only use a mobile for the odd phone call and have no idea what an "android note 8" is. However, I have self excluded for poker and all the other nonsense that now exists on here.

its called "3rd party authentication" sparrow. It should be obvious that it needs a 3rd party device.  If you don't have one it's impossible.

Well this is all gobbledygook to me. I thought Betfair was reasonably safe and if their website is hackable surely it's their responsibility ?

Ok, thanks dave.

even Outlook, the easiest email to hack, flags up when you are abroad.

Apparently salmon we all need "2 step authentication enabled by 3rd party authentication" .

2 step security Edit
2-Step just takes a couple of minutes to activate and is really simple to use! Just follow these 3 easy steps:
What sort of phone do you use?
iPhone
Android
Windows
Blackberry
1Install the Google Authenticator app from the App Store on your iPhone.
2Configure Google Authenticator
Open the Google Authenticator app.
Tap + and ensure Time Based is selected.
Tap Scan the barcode and scan the code below using your iPhone camera.
Enter the details manually instead
3Enable 2-Step Authentication
Once you have scanned the barcode, enter the 6-digit code generated by Google Authenticator in the field below.

I don't have a smartphone. Not an age thing I am mildly dyspraxic and haven't got the fine motor skills. I have got a tablet which I can use after a fashion though only with a stylus. Didn't even know it had a camera. It does appear to have something that looks like one but I wouldn't have a clue how to use it to take photos,never mind to scan things.

You dont have to scan the image you can manually put the code in the first time to set it up
once done its as easy as opening up the app and putting the number it shows into the bf sign in box

Yhat said, the pitiful picture you paint SS I doubt it would be of much use.
Since the number changes every 60 seconds so you have to input six numbers in before it changes and it might be beyond you.

actually it might be 30s

You surprise me a little salmon but with me I have only been interested in computers and loathe mobile technology. I had a touch screen phone and just couldn't get on with it and changed back to a very basic one. I have never used a phone online and probably never will and I agree with you that Betfair are irresponsible with regard to this problem.

Dusty.

As salmon said, gobbledygook of the highest order. For gods sake all people want is to put bets on not go on a technology course.

I could put the number in but I doubt I could get to that stage. And anyway I only use the laptop at home,the tablet is in a drawer somewhere and will only come out when I next go away in some months. Would I have to fiddle about with that every time I logged in ?
And please don't use the word app which as far as I am concerned has 4 letters.

Good to know I'm not alone with phone technology. I do not use a smart phone either despite having a Blackberry (yes, Blackberry with no internet set-up); I cannot hack touch screen to save my life!

No tablet either just laptop,...powering it up and closing, no cutting and pasting. If it goes wrong I'd just bin it and/or get a "new" one but always refurbished (a return, not used).

Once set up 2-step is required everytime to access the account, thats kind of the point.

For those who suffer from technological neurasthenia, blame those who promote opportunism as being virtuous who encourage development for developments sake, and those who are malevolent enough to use it as a maxim for theft.

It is the human condition to attempt to take as much as possible, thats why regulation is required.

Capital punishment should be mandatory for both hackers and geeks imo.

King of Dubai    03 Dec 17 14:22 
Reminds me of teaching my nan to use a microwave.





I expect your nan could teach you far more important things.

Ok, Taff.

lol don't know where the "3rd party" came from

Anyway sparrow I still don't see what you expect them to do.  They offer a method of improving security that's available to the majority of their customers, if you are in the minority, suggest something to them, don't moan about something that works.

I simply don't see why their customers should have to purchase an extra gadget to enhance the security of their site. As salmon said this is their responsibility not ours.,

Debates about insider hacking aside.  How does 2 step enhance the security of Betfair's site?  It enhances the user's security not the security of the betfair site.

If I don't give my username/password to anyone else ( and I haven't ) then if somebody gets into my account and clears it out surely that's Betfair's fault not mine.

Always use different passwords for every online site betfair/email/banks etc, i just got a couple of different digits at the end for every site, you will always get someone dodgy/desperate insider where money is involved.

salmon if you don't give your password to someone else, no one will get into your account.  So you can rest easy. 

(There has never been a case of anyone getting their pc infected by some sort of malware ever, so your def ok.  And these hackers are apparently getting stupider by the day and operating systems aren't being pressured by governments to create backdoors, so nothing is likely to change.)

@salmon spray -- one common mistake people make is using the same password for more than one site. As soon as one site is hacked and credentials stolen, the bad guys try the same password on other accounts and other sites.

My account was hacked 7/8 years ago a b d a bet placed on a match in peru only €2 though,betfair were not surprised and said it was hackers trying to prove a point.

NEVER NEVER NEVER Leave funds in your account,especially over night

You are caught now with the three day pending transaction are you not so taking funds out everynight becomes confusing

You can't take funds out overnight. The withdrawal is still there if you want to deposit 24 hours later.

To the earlier posters that don’t want to purchase a new device for 2FA – in an age when people change their smartphones every couple of years, surely a family member will have an old one hanging around that they can let you have? (I have at least 6 in my bottom draw). It’s not like it needs to have a sim card or anything to work and it really is worth using 2FA.

Also somebody mentioned earlier that you need to enter the number every time that you access the account – this isn’t true as you can mark a device that you use as a “trusted device” – say for example if you are using a home PC. It will only ask you to renew the verification every 30 days.

You can use Google Authenticator on a Windows PC apparently. The "app" you have to use is a windows program called WinAuth

If you google "How to set up and use Google Authenticator on your pc" there are lots of step by step guides and there are vids on youtube too.

withdrawing and depositing each day will make you look like a problem gambler or a money launderer. Linking Paypal to the acoount could allow the hacker to take all your money.  Also I remember  a complaint about bwin/Party where the hacker was able to deposit viaPaypal without using the Paypal password.  Paypal refused to void the transactions claiming that they were authorised.

dave1357, I do precisely that (here) all the time especially after the culmination of an antepost bet. Also, the fund goes straight into my bank account, and not Paypal; others go thro' Paypal, but an email address and password are prerequisite prior to and before a fund transaction; Paypal will also send an email to notify the fund is with them prior. So far, so good, and I'll expect this status to carry on in the future.

Reading the above I realise I am out of my depth. I shall be closing all my accounts and taking a hammer to my laptop. I shall order a newspaper and pop into a betting shop occasionally.

Eye ham  with  u  salmon

Thank you Comrade.
Up the Luddites.

Apparently all we need is the "Google Authenticator" for our PC and then we can all live happily ever after.

I was using the 'Google Authenticator' for (here) on my PC. I'd be sent a PIN every time to use to finalise my log in, but found it annoying and tedious nevertheless; I understand it is a price worth paying for additional security.

There is no way round this, I'm afraid,...not even face recognition as that could be compromised, I believe.

If you don't clear your cookies then you only need to enter it once as your PC becomes a trusted device.

@impossible123

Here is a thread where someone not only lost their funds but also had paypal deposits used

http://blondepoker.com/forum/index.php?topic=67559.0

The problem with paypal isn't cashing out it is the hacker depositing funds from the paypal account.

Also as I said depositing/withdrawing everyday will either look like a compulsive gambler which will affect you if you want a mortgage or other substantial credit (unless you use a separate account) and if there are substantial amounts involved your account will be flagged for potential criminal activity.

https://en-betfair.custhelp.com/app/answers/detail/a_id/126/~/two-step-authentication-help

Betfair’s two-step authentication reduces the chance of having your account compromised.

That’s because in an addition to your username and password Betfair will ask you to enter a one-time code, which will be sent to your phone via SMS or displayed by the Google Authenticator application for iPhone, Android, Blackberry and Windows Phone. This authentication scheme protects against a range of attacks and eliminates the risk of insecure/easily guessable passwords or shared password being leaked from other websites you use.

This feature is important if you care about the security of your account. When you have enabled Betfair’s two-step authentication, attackers not only have to know/guess your username and password but also guess an additional one-time password, which changes every 30 seconds. It is practically impossible to perform this type of attack due to the computational complexity it carries. With two-step authentication your Betfair account will have the best protection available.

How do I turn it on?
To turn on the two-step authentication feature simply login to your Betfair account and visit ‘My Account’. Under ‘My Security’ tab you will find the setup screen. Just follow the instructions to sign up and configure your options. It only takes a couple of minutes.

How do I use it?
Two-step authentication is very easy to use and you will quickly get accustomed to the process. You start by logging in as usual. You will be presented with an additional login screen if your credentials are correct. Open the Google Authenticator from your phone and type the verification code in your browser. If the code is correct, you will be logged into your profile. You can choose to do this for every login or only for new devices within 'My Security'.

How do I disable it?
To disable two-step authentication simply visit your ‘My Security’ page under ‘My Account’. If two-step authentication is enabled for your account the status of this feature will display the message ‘On’. Click on the drop down and click ‘Turn Off’ in order to turn of two-step authentication.

Additionally you may choose to temporarily disable the feature. There are two options you can choose from: ‘Suspend for 1 day’ and ‘Suspend for 1 week’.

In case you are unable to use the two-step authentication, we can temporarily suspend it for your account. The two-step authentication can be disabled for 1 hour, 24 hours, or 7 days, during which you will be able to log in without entering the code.

How do I disable two-step authentication once it’s suspended?
After we temporarily suspended your two-step authentication, you can completely disable it from My Account. For this, you will just need to login to your account, access the My Security section, the two-step authentication area. Select ‘Resume’, and then select ‘Remove’. This will leave your account without the two-step authentication configuration and you can add it again on a new device.

When you set up the two-step authentication you will be presented with a list of backup codes. These codes allow you to login without your phone by appending a code at the back of your password.
Example:
If your password is ‘B3tF4!rsm$r7’ and one of the backup codes is ‘367622311’ your final password will be ‘B3tF4!rsm$r7367622311’. For a list of all backup codes visit ‘My Account’ -->’My Security’ page.


What happens if I don’t have backup codes?
If you have given us your mobile phone number, you will have the option to send a one-time password by SMS. If this doesn’t work, you will need to give us a call. Your account security is very important to us. We will set you up in no time after we confirm your identity. Be prepared to answer some security questions related to your account.

A ‘trusted device’ is a computing unit, such as your personal phone or laptop, which you specifically approved by ticking the 'Tick to confirm this is a trusted device' when logging in. When logging in to a trusted device you only need to enter your username and password. You will prompted to enter the verification code for each new device the first time you login. Once approved, the device will be added to your account.

Why use trusted devices?
By limiting the access to your account solely to a list of known devices you only need to login with your username and password. This removes the need to go through the two-step verification code on every login without compromising your account security provided by the two-step authentication login.

How to use trusted devices?
The first time you login from an ‘untrusted’ device you will be asked to provide your two-step authentication verification code. You need to tick on ‘Remember this device for future logins’. Once you login successfully, the device will be added to the approved devices lists. It is as simple as that.

How to un-trust a device?
In order to un-trust a device simply visit ‘My Account’ --> ‘My Security’ page and click on the ‘Edit’ button next to Login Settings. Check the ‘Forget previously trusted devices option’” and click on the “Save changes” button. Old trusted devices will be instantly forgotten and will need to be re-verified at next login.

Which Betfair products do not explicitly ask for a verification code?
In addition to some third party products, the following Betfair products will require you to append the Google Authenticator code to the end of your password in the password field to successfully login.

Mobile Web Exchange (touch.betfair.com)
Lite (lite.betfair.com)
Mobile Timeform (timeform.betfair.com)
iPad Exchange native app
Mobile Mobet

Which 3rd-Party products do not support Two-Step Authentication?
Using the approach described above, in most cases will allow you to successfully log in to 3rd-Party products with two-Step Authentication. However the following products are known not support the current technical approach and should not be used in conjunction with two-Step Authentication.

Bet Trader Evolution
Automated software (or bots) accessing the legacy Application Programming Interface, known as API6, will not continue to operate if Two-Step Authentication is turned on. This is because the automated software does not have the ability to submit the one time verification code provided by Google Authenticator.

The next generation Application Programming Interface, known as API-NG, is available and provides an alternative strong authentication mechanism. Please contact the Betfair Developer Program for more information.

Why wouldnt anyone automatically clear cookies when closing their browser?
The amount of tracking websites do you dont really want that stuff staying there imo

Somebody also said earlier to have different passwords for everything. this is obv aquired wisdom that I think everyone now knows, but to say the person in question just had extra digits on the end to differ is silly

Brute force attacks would creack those only slightly less easily than having the same passwords.

The generally agreed best formula for creating passwords are to chose five totally random words for a master key and use a password manager

why would anyone *NOT clear cookies I meant

The longer this thread continues the more ridiculous it gets.

You can also use Google Authenticator for your email accounts.  A hacked Email account can be very costly.

They could stop this if they stopped transfers to poker and only allowed withdrawal to the card depositing
It really is too easy fr crims to empty accounts via this method

Pedro39 had his account hacked,money was bet on some foreign footy game,apparently it was traced to Ukraine,Betfair reimbursed after checking betting history but closed the account and opened another.
Good job I was here to help poor pedro

I had my account hacked and the perpetrator added a skrill account with a totally different e mail address to my own to repeatedly deposit 10 and then withdraw 100. I was of the belief you couldn't, in such a situation for security purposes, withdraw more than you'd deposited.

Betfair reimbursed me and closed my account and would only reopen another if I used 2 step verification and used a different e mail address.

Is the OP going to update us? For the life of me I can't remember the forumite's name but it's on the tip of my tongue. A few months back he had 3k taken out of his account and Betfair to their credit saw sense and settled the issue. Anybody remember his name?

It was me Mr B. But under my old name 'Chalkie'
I left this the other day if it was any help to the OP Akajak

It was my account that was hacked that Bigfield refers to i think see below if it helps http://community.betfair.com/horse_racing/go/thread/view/94102/30860069/account-g-emptied
All sorted(justifiably)in my favour in the end. I hope you ultimately get sorted as well mate