Tag: Phishing

Today I received an unexpected SMS:

********** deleted from Microsoft account ********@********.com. Not you? https://account.live.com/********

I have omitted the mobile phone number, the email address and the full URL that was supplied in the SMS for security reasons. This particular email address and mobile phone combination was not mine but someone I knew and helped setup the account for. The mobile phone number and email address were all correct. When I contacted the owner of the email address they also received the same SMS, I told them to not open the URL and wait until I come over to see what is going on with their account or wait until I finish work and I work them through what to do to make sure their account is safe.

There were no other emails or SMS sent after the first, so I can only assume it was a phishing message to get us to log in to whatever the URL re-directed us to and provide them with the complete email address and password. Neither of us did, and when I looked into the security activity on the account Microsoft had blocked access to someone logging in from an unusual location a number of times. Good on them for doing this. A quick and easy password change, ensuring two factor authentication and a couple of other security tweaks were made, and I was significantly more relieved that the account was secure.

Remember people, keep your account’s security up to date. It does not take a long time but checking your security for your accounts several times a year is critical (I generally do it every 3-4 months, depending on the account). Ensuring good security practices are followed will make you safer online and ensure your details are not leaked and/or stolen by an unwanted party. I suggest to:

1. Change your password several times a year.
2. Ensure your password is complex and nothing simple or easy to guess (a password which is long, has alpha-numeric characters, symbols is going to be harder to guess than a standard dictionary word or something simple with no symbols)
3. Enable some form of multi-factor authentication where available
4. Review any logged in sessions and close, revoke and report any you don’t know or are not familiar with
5. Review any applications that may also have access to your account and what data they have access to, revoking or removing any unusual or unused applications

It is always better to be safe than sorry. Don’t wait to have your accounts broken into and your information stolen or hijacked, be proactive and ensure good security practices are followed. If others have useful ways to keep your accounts safe then post in the comments below.