[INJAXN]

Looks like this is common with Netflix. I cancelled my subscription well in advance but still was charged Rs 878 by M/s NETFLIX.COM AMSTERDAM NL. So, I filled dispute with hdfc to get my money back.
Not sure why netflix.com amsterdam was mentioned in the transaction.

[AltoLXI]

Originally Posted by SilentEngine

I would suggest couple of things:
1. Never use debit card for such purposes. A credit card is always more safer to use than a debit card. If you don't have a credit card, you should get one whenever you can.
2. Remove debit card information form the account to prevent any future misuse, if possible. You can consider blocking it too but it will not be easy to get a new card right now with the lockdown.

Originally Posted by Thermodynamics

A useful tip (suggested by a colleague); pickup a credit card with lowest credit limit, something like 40k. Use that as a beater card for everything, online shopping, swiping in shops, gas stations etc., and save your peace as the stakes aren’t high.

I do have Credit card but as the credit limit is high I used the debit card as the balance in account is very less. I cancelled the subscription to Netflix today.

Originally Posted by raksrules

First of all, your account was not really hacked in the sense that you think. You probably used a very weak password and the password is there somewhere on the internet which they obtained in some list of passwords file and it may be from your some other account. Then they ran a program and tried your that password on netflix and it worked. So that account was then sold to someone for a dollar or two and since you said your email id was changed, good chance the account was sold with email access, which basically means your Netflix and Email, both passwords are compromised.

This usually occurs because people tend to use same / similar and simple alphanumeric passwords on websites and running a brute force on them is pretty simple.

I suppose this is the issue. I remember getting a mail in the past where the mail contents showed my password. To my horror it was password linked to my other mail ID. The mailer asked me to pay in bitcoin and I ignored the mail. Incidentally the Netflix account was linked to mail-id where I received that mail and password was set to the other mail-id password which was known. I suspect this is how it was accessed.

I suspect the debit card number is not known unless a trojan used key stroke logger to get my debit card number. Even if they got it, a pin / OTP is still required to access my account right? The debit card is new one with chip facility and never used apart from Netflix. The account does not have much money though.

[SilentEngine]

Originally Posted by AltoLXI

I suspect the debit card number is not known unless a trojan used key stroke logger to get my debit card number. Even if they got it, a pin / OTP is still required to access my account right? The debit card is new one with chip facility and never used apart from Netflix. The account does not have much money though.

Is the debit card details saved with Netflix? Then whoever got access may have also got the card details, depending on how Netflix displays the information in the account details. So it's best to either block the card or disable international transactions on it.

On the other point, PIN/OTP requirement is an India specific regulation. International transactions easily bypass this and have ability to directly charge the card just with saved card number and expiry date. That's how Apple/Google/Netflix etc charge for automatic renewals.

In fact, I myself have Netflix account which was opened as a free offer from HDFC bank, but I had to provide card information to complete the registration. Netflix enabled auto renewal and I forgot about it, and it charged me automatically. The SMS received from the bank specifically mentioned that the transaction was carried out without RBI mandated PIN/OTP.

Netflix even makes it difficult by forcing one to login to the web version to access account details. Mobile app doesn't provide account access.

[AltoLXI]

Originally Posted by SilentEngine

Netflix even makes it difficult by forcing one to login to the web version to access account details. Mobile app doesn't provide account access.

I cancelled the subscription. The account is still active for another 2 days.

Originally Posted by SilentEngine

Is the debit card details saved with Netflix? Then whoever got access may have also got the card details, depending on how Netflix displays the information in the account details. So it's best to either block the card or disable international transactions on it.

When I login via mobile to the account, the card number section shows only last 4 digits others are obfuscated. I suppose the account number is not stored in plain text format on server but encrypted. When the account details are shown, the last 4 digits of decrypted number only should be shown. But who knows how is the security implemented?

[akbaree]

Same thing had happened to me as well - almost an year back. You may want to consider setting two step authentication on your primary email. I don't think an email can be changed without compromising the email access too.

I don't remember exact steps now because it is an year old incident but I have not two factor authentication on my primary that I use for singing up and haven't faced issues since then.

[AltoLXI]

Originally Posted by akbaree

Same thing had happened to me as well - almost an year back. You may want to consider setting two step authentication on your primary email. I don't think an email can be changed without compromising the email access too.

I don't remember exact steps now because it is an year old incident but I have not two factor authentication on my primary that I use for singing up and haven't faced issues since then.

I logged into my SBI account and disabled the CNP channel for the card used in Netflix. Is this better than blocking the card?

[GTO]

Originally Posted by raksrules

First of all, your account was not really hacked in the sense that you think.

Even I was wondering how a Netflix account got "hacked".

If someone tries bruteforce password trial & error, I'm guessing that Netflix has some sort of protection against it (the relatively tiny Team-BHP does ).

You probably used a very weak password and the password is there somewhere on the internet which they obtained in some list of passwords file and it may be from your some other account.

I think it's either one of these two:

1. Phishing via email. You click on an email that looked like its from Netflix, enter your username & password, but it was actually a phishing mailer.

2. An existing virus / keylogger on the system.

Shame on Netflix for not having any sort of 2-factor authentication. They do allow you to add your phone number though. Suggest all BHPians do the same as you can quickly recover your account if a cellphone is added.

[StarrySky]

My friend's Netflix account (in Finland) was hacked too. He was using Netflix mainly on TV and I suppose it remains always "logged in" - so this hacking did not come to light immediately, and he was able to continue using Netflix normally. Some time later, it was noticed that the email address associated with the account was changed, and then it was found that he couldn't log in from mobile app using his original email and password - it gave an error that the email was not recognised. Searching his mail inbox revealed that he had received two mails - regarding change of password and change of email address - some time back. Anyway, he was able to get back access to his account after calling the Netflix customer support.

[harry10]

5 of us share the same Netflix account so the cost comes to only 160 per person every month. However couple of months back I wasn't able to login via TV, mobile or laptop. Messaged the primary account holder and he too wasn't able to while getting same password error. We managed to change the password but couldn't understand why Netflix wasn't accepting our password. Seems it might have been hacked and password changed at that time.

[arakhanna]

I unfortunately too faced the same on NETFLIX. I had an old account which I had stopped using and one day got an SMS and email from my credit card co in GBP. Luckily the card was an AMEX. Called them up right away and they cancelled the card and immediately refunded the amount and mailed a replacement. I did not contact NETFLIX. Just let it be. I have a profile on my Dad's connection hence had stopped using that account.

Not sure where they got the password from but i am sure that my email account was not hacked. For NETFLIX my password was my name.. I guess I had it coming. I now use more secure passwords.

[huntrz]

Happened with me last year during 2nd or 3 month of start of netflix subscription. The customer care was able to restore my account. After that my faith in netflix was hugely shaken. They take it very casually, almost like its a regular affair. I don't think they have even decent enough competition and that is why they are taking customers for granted. I also discontinued it for a while, but again seeing the stuff they dish out on TV these days with greedy dth pricing along with generous dosage of ads particularly on hindi channels made me hate TV more than netflix. So subscribed again. I think keeping a tough password should be fine.

[Spinnerr]

Originally Posted by GTO

Even I was wondering how a Netflix account got "hacked".

My guess if from previous data breaches.
In 2018 lot of accounts came up in the dark web, there were security advisory about the same.

There could be other unknown/hushed up breaches, which could have leaked a lot of user credentials. And some group must be using their stash.

But I haven't figured out how they profit from hijacking ones streaming account. One possibility is to assume the user would have used the same UserID/Password for other services and try that out.

[atulsian]

Originally Posted by GTO

Even I was wondering how a Netflix account got "hacked".

If someone tries bruteforce password trial & error, I'm guessing that Netflix has some sort of protection against it (the relatively tiny Team-BHP does ).

.

There are tools which uses residential proxy to brute force with username/password list which has common passwords. Also, botnets, pulls data from your browser (remember password) and keylogging.

I know few sites which sells any streaming site login with some warranty too.

[DudeWithaFiat]

Strange. Because when someone tries to change his/her e-mail address in any account, the common practice is for the application to send a confirmation e-mail to the existing e-mail address or an OTP to your cell before it actually changes the email address in their database. I am pretty sure that a an App as widely used as Netflix will definitely do it.

If this has happened:

• Suspect number 1 : You must have clicked on a link from a phishing e-mail.
  
• Suspect number 2: Someone has access to your email already or a key-logger is on your system.
  
• Suspect number 3 (related to no.2) : Check the apps installed on your Smart Phone. Remove any apps that is not familiar to you or that is not widely used.

Tip:- I have read somewhere blocking/reverting a transaction made on your debit card is a lot harder than doing the same on your credit card. So I never use by debit card on any apps/websites for recurring auto-payments where they are going to store that info. I always use my Credit Card for such things.

[wheelguy]

This may sound rudimentary but this is one of my plans to create a safety net against the internet/online frauds:

Also using virtual debit/credits cards which come with transaction limits and limited validity of 1 to 2 days can help a lot in creating safety nets.