Brother's account stolen +++

[altwight]

Background

My brother got the Ashes of Al'ar mount a long time ago. I was at my buddy's house a week or two ago and I was like 'yea my bro has that mount ill show you' So I go to log in my bro's account and I notice there's an authenticator attached to his account. I call him and ask him to press the button for me and get the key. Wellllllllllll turns out he never bought an authenticator and actually quit WoW about 3months ago.

So my bro's account was apparently compromised and the person who stole it placed an authenticator on it. Are we shit out of luck? My brother is in the navy and is currently out at sea so he can't do it himself. I have the infos so I could do it but just need to know what to do.

edit: Also his character's names aren't showing up on wowarmory

[SamanosukeShiva]

did he ever changed his account to battle.net before quitting? if not, then im afraid it's fucked.

sounds like the account already sold/transferred to me.

[Boyiee]

You can call, but you have to pretend to be him. Even say you were away on duty or something when this happened.

Because of the authenticator being put on it, they will most likely require you to fax your (his) drivers license to them as proof of account owner.

You are somewhat fucked because they would have had to convert it to battle.net, but you cant change 100% of the info even with that, so you might get lucky.

It's going to be a long process, first the 30+min hold time on the phone to get someone to speak to, and then the call itself (10min). Then it's all a waiting game. With simple account recoveries before battle.net, you could get your stuff back within 1-4days.

[Norellicus]

His account would have had to already be battle.net if he was able to actually get the authenticator prompt; if it was converted, your old username no longer works (at least as far as I know...), so that may make it a little easier.

[altwight]

http://img200.imageshack.us/img200/411/71395843.jpg



The fake one consist of the following info

Greetings!
It has come to our attention that you are trying to sell your personal World of Warcraft account(s).
As you may not be aware of, this conflicts with the EULA and Terms of Agreement.
If this proves to be true, your account can and will be disabled.
It will be ongoing for further investigation by Blizzard Entertainment's employees.
If you wish to not get your account suspended you should immediately verify your account ownership.

You can confirm that you are the original owner of the account by replying to this email with:

Use the following template below to verify your account and information via email.

* First and Surname
* Date of birth
* Address
* Zip code
* Phone number
* Country
* Account e-mail
* Account name
* Account password
* Secret Question and Answer
If you ignore this mail your account can and will be closed permanently. Once we verify your account, we will reply to your e-mail informing you that we have dropped the investigation.

Regards,

Account Administration Team
Blizzard Entertainment

Whereas the second one is a normal this is an automated response do not reply etc.

My brother's account was hacked (he's out at sea right now, in the navy) and I was going through his emails to check and see if there were any clues like a notification his PW was changed (which there was) and stumbled upon these fake blizzard emails.

I can't tell the difference in the fake and real email addresses. How'd they do that?

I know my brother didn't fill out any of those false emails because I checked his sent box and didn't find anything sent like that and he's out at sea. I also know the battle.net email wasn't changed on my brother's account because it would have notified him @ his email's inbox.

I contacted billing@support and said "my account was accessed by a third party program and now has an authenticator on it"

[Korietsu]

http://img200.imageshack.us/img200/411/71395843.jpg



The fake one consist of the following info



Whereas the second one is a normal this is an automated response do not reply etc.

My brother's account was hacked (he's out at sea right now, in the navy) and I was going through his emails to check and see if there were any clues like a notification his PW was changed (which there was) and stumbled upon these fake blizzard emails.

I can't tell the difference in the fake and real email addresses. How'd they do that?

I know my brother didn't fill out any of those false emails because I checked his sent box and didn't find anything sent like that and he's out at sea. I also know the battle.net email wasn't changed on my brother's account because it would have notified him @ his email's inbox.

I contacted billing@support and said "my account was accessed by a third party program and now has an authenticator on it"

Email spoof. If you pull up the header for the email, you should see the real address.

[Correction]

The content of the email is classic scam; blizzard never double checks if it suspects your account of anything, and certainly doesn't ask for your personal info over email.

[Edgie]

So He quit wow, and this is still a problem, is he ever gonna go back to playing wow?

[altwight]

So He quit wow, and this is still a problem, is he ever gonna go back to playing wow?

Well he probably won't ever come back but once his account is back I'll probably use it just in my spare time. He's got phoenix mount which all my friends drool over.