Account Takeover Through Compromised Email Accounts

A growing account-takeover method involves scammers first obtaining access to a victim's email account. Stolen email credentials may originate from previous data breaches, credential leaks, phishing attempts, or other compromised online services.

Once the email account is compromised, the scammer may attempt to use it to gain access to other accounts associated with that email address, including digital payment token (DPT) accounts.

How does it happen?

Credential reuse

If you use the same email address and password across multiple online services, credentials compromised on one service may be tested against other accounts.

For example, if the password used for your email account is also used for another online account, a scammer who obtains that password may be able to access both.

Password reset exploitation

Even if your passwords are different, access to your email account can still create significant risk.

A scammer controlling your email may attempt to reset the password of accounts registered to that email address. They may then be able to intercept password-reset links, OTPs, security notifications, or other information delivered to your inbox and use them to take control of the account.

How can I protect myself?

Use a unique password for your StraitsX account that you do not use for your email, banking, social media, or any other online service.

Your email account is particularly important to protect because it may be used to recover access to many of your other accounts. Use a strong, unique password and enable multi-factor authentication on your email account whenever available.

If you suspect that your email account has been compromised, change its password immediately from a trusted device and review your email account for unfamiliar login sessions, forwarding rules, recovery details, or other changes.

You should also review the security of other important accounts linked to the same email address.