Account Hacked on Stars Currently

[newstop]

. Users should be allowed to disable the interacct transfer feature if they want...and it could only be reactivated via email...i dunno how easy it would be for hackers to spoof your email addy.....

This is an excellent suggestion. I realised this , after my Party account was hacked last Friday, while I was logged on . The hacker changed my email addy and log in name, and transfered 80% of my Party bankroll. Half hour later, when I tried to log back in it wouldnt let me. Upon calling support, I was informed that my log in information was all wrong. To cut a long story short, after 4 days of back and forth, and after emailing numerous documents proving my identity, the money was finally transfered back into my Party account. I want to point out, that I had taken a number of precautions (including both a hardware and software firewall, anti virus software, etc.). Now I have taken to keeping only that amount of money in my poker accounts , that I can afford to have stolen.

[darkcore]

i'd go with

1) I'd request the transfer
2) PS would email me a link with a certain lifetime for confirmation
3) PS would wait until i have followed the link and and confirmed the transaction or the lifetime expires

it shouldn't be that hard to implement a feature like this that works automagically and it'll make the site much more secure.

[DrewOnTilt]

[ QUOTE ]
***3. And for god's sake, one feature EVERY site needs to implement NOW is to make your login name DIFFERENT FROM YOUR SCREENAME! This is such a no-brainer, it hurts. Raymer had his Stars account hacked last yr b/c someone knew his Stars screename (obviously) and guessed his password, which raymer admits was far too weak.

well, this is inspiring me to go change all my poker site passwords to something more cryptic.

[/ QUOTE ]

I mean, duh, that is so obvious. There are two keys to getting into your account: your username and your password. Half of that equation is on full display for the whole world to see.

At my place of employment, the IT department specifically disallows applications from using the phrase: "Sorry, but that screen name is already taken," or anything similar. The phrase must be something like "Invalid screen name." "Screen name does not meet login rules" "Please select a different screen name", etc. Why? Because a hacker or other malicious person could obtain part of the information necessary to break into the system in question simply by entering random usernames.

[wonderwes]

I think it should be difficult to transfer money opposed to easy.

Its money, you should be required for more things to verify to transfer cash. A 4 to 6 digit pin would be ideal.

To have a security pin code has a lot more pros than cons.

[Josem]

this is the realistic endpoint for such situations: http://en.wikipedia.org/wiki/SecurID


Obviously, the implementation cost would not be insignificant, but:

a) I (and, I imagine, many other players) would be happy to make a contribution towards the cost of such devices.

b) it would only be needed for people who have significant chunks of money in their accounts

[lockplayer13]

On sites like AP or Full Tilt, from what I understand there is nothing to confirm that you are transferring to the right person, at least on Stars it shows the city.