Usually companies send the 2FA token once the password has been entered. So someone has your password and you're only saved by 2FA.
So you can start by changing your password maybe?
Ask HN: Someone is trying to reset my email password
11–16 of 16 posts
Re: Ask HN: Someone is trying to reset my email password
#12I’m being driven crazy by this sort of thing. Password resets for my Facebook account etc. But the worst ones I get are someone signing up for a service using my email address where the service doesn’t verify the email address. The cherry on top is when this is done in language that I don’t understand. I was getting Netflix account information and Uber trip receipt emails in Spanish for a while with no option to say…
For cases like that, if it doesn't seem like an accidental screw-up on their part and actually some attempt at impersonating you, an option might be to reset their password and close the account.
Actually, even if it's accidental, if you do it close to when they've opened the account (when you started receiving the mails), they wouldn't lose much if any data.
Of course, that's assuming that you have no way to contact them. If you can, that might be better.
EDIT: Changed "their account" for "the account" since it could be said to be yours too since it's your email. They effectively signed you up.
Re: Ask HN: Someone is trying to reset my email password
#13I’m being driven crazy by this sort of thing. Password resets for my Facebook account etc. But the worst ones I get are someone signing up for a service using my email address where the service doesn’t verify the email address. The cherry on top is when this is done in language that I don’t understand. I was getting Netflix account information and Uber trip receipt emails in Spanish for a while with no option to say…
For cases like that, if it doesn't seem like an accidental screw-up on their part and actually some attempt at impersonating you, an option might be to reset their password and close the account. Actually, even if it's accidental, if you do it close to when they've opened the account (when you started receiving the mails), they wouldn't lose much if any data. Of course, that's assuming that you have no way to contact…
Yes, I’ve done a few things like that. I even cancelled a haircut. A lot of services can’t be cancelled and require a phone call. I was on the phone with Netflix for over an hour trying to cancel a service - they initially didn’t believe me that google allow emailaddress@gmail.com and email.address@gmail.com to go to the same account. I had to set up the alias in gmail to allow me to send mail as email.address@gmail.com and email the technician from that address.
Hours of my time wasted because a company doesn’t verify emails.
Re: Ask HN: Someone is trying to reset my email password
#14Usually companies send the 2FA token once the password has been entered. So someone has your password and you're only saved by 2FA. So you can start by changing your password maybe?
Thanks. just did
Re: Ask HN: Someone is trying to reset my email password
#15I’ve had some password reset mechanisms send me codes without the attacker needing to know much. I believe this has happened with facebook before; my password there is unique and random, and even after changing my password to another random one, I still got a couple of occasional 2FA codes. Not sure if they’ve changed anything there to combat this, but just my 2¢.
Re: Ask HN: Someone is trying to reset my email password
#16Its upsetting email providers still dont provide soft ip lock, at least for settings, that if you dont access from ip you really need to go more complex recovery options, considering infrastructure cost they could even charge for it.
The IP address is far from a reliable signal for identification, and shouldn't be used like that. Many (most?) ISPs around the world use dynamic IPs, and then there are mobile phone networks.