Account Hacked, NO response from Spotify, Horrible security flaws!

[albionheroqueen]

I'm really disgusted right now. I have tried to contact Spotify via email (responding to the email notification that someone logged into my account and changed my email and password WITHOUT giving me a chance to intercept and say, "hey, that's not authorized", AND writing directly to the "account-details-changed(AT)spotify(DOT)com" email as instructed), I have tweeted and direct messaged their "SpotifyCares" account on Twitter, tried contacting via Facebook, and utilized the online "help" form. I use quotes because help is very loosely implied.

First of all, if a simple security feature (which most every other service has) was implemented, there would be far less angry PAYING customers posting on these forums about how easy it is to get their account stolen and how it is like pulling teeth to recover their access. Perhaps a password reset could be done if the link wasn't sent to the hacker's email. We are absolutely barred from our own accounts and Spotify will not respond with so much as an automated, "Hey, we're looking into this" or maybe even locking the account down until things are fully investigated. No, some jerkbag in Korea who stole my information gets to leech off my account while I sit here spending New Year's Day desperately trying to contact someone to at the very least CLOSE the account.

You guys have no phone support. No chat support. This is pretty much the last thing I can do to try and get someone to respond, and in order to do so, I had to create a new free account just to login and post. Your system is flawed. Your customer support is lacking. If you can have agents posting on Twitter about non-crucial things, you can have agents helping those that PAY for your services to recover their accounts. 

Sincerely,

One very angry, soon-to-be former customer whose main (and compromised) account name is "indiegarona"

[kiltsaresexy]

This is ridiculous. It's things like this that make me really consider taking my credit card off of the account. if it's that easy to take hold of someone's account, how easily can they get our other info? 

[albionheroqueen]

From what I have been reading in these forums (with all the time I have been spending WAITING for some form of response from customer "support"), I am seeing more and more paying customers suffering the same misfortune due to a HUGE security flaw in the system. Not only does it suck that someone can breach your account and change your email and password (but keep using your premium service), but from what I am reading, people are waiting days, weeks, even months to regain access to something they PAY for! So, yes.. I might think twice before paying for these "premium" services again once this debacle is over.

To anyone else having to deal with this, I will update this thread if and when I am contacted by Spotify "support" to receive some sort of help with this matter. That should give you some idea of what the turnaround time is for someone who has used EVERY available avenue of contact and communication to try and get some assistance.

Signed,

A very disgusted, still unhelped, soon-to-be former customer

[kiltsaresexy]

I mean, we are PAYING customers. Keeping our accounts secure should be a freaking priority. I'm probably about to bump my free acount down and just use good old youtube from now on. 

[albionheroqueen]

I'm pretty diligent about security from my end, but things happen, and I understand that. What I find highly unacceptable is the lack of response that users in my position are having to deal with. I'm also pretty ticked that all of the playlists I created for use while I edit my photography work, write my novel, and take long drives are inaccessible and likely deleted at this point.

Bad form, Spotify.

[albionheroqueen]

UPDATE: I finally got an email from Spotify, as well as a response to my DM on Twitter. They want everything short of a blood sample to prove that the account is mine. I happily provided them everything they asked and more. It is a real shame that they don't take account security this seriously BEFORE a breach happens to a user. I cannot stress enough, Spotify, simple security measures need to be implemented when someone wants to change your account information.

Still locked from my account, but then again, so is the hacker, so I am okay with that.

I will still be cancelling my paid subscription once this debacle is over.

[albionheroqueen]

Updating again. Still no word from Spotify support. They responded to my Twitter DM response with a generic:

"We're glad our team is already on the case. You should get a reply from them soon. Remember we're just a tweet away if there's anything else we can do in the future 🙂 /BX"

A "tweet away" seriously? Not really. This whole fiasco is getting old quick. The ONLY email I have received since responding to Spotify's long laundry list of required info is from the hacker him/herself with the subject line of "Spotify" and a message of "trolololololololol". Seriously, Spotify... it seems that you favor the jerks who steal from your paying customers. I cannot stress enough... PREVENTATIVE security measures. How hard would it be to implement some security questions or even more simply, a confirmation email that requires the ACTUAL account holder to confirm the changes?

[albionheroqueen]

Update: Spotify Support has gone radio silent. 

[Oversalted]

Okay, there is very big Industrie which Crack these Accounts and put them into Generator and sell them ://

Thats sucks so hard -.-

[indiegarona · Accepted solution]

Well I got my account back. The first support rep who contacted me just fell off the face of the planet, so I got someone else via the web contact form. He ended up restoring my account within an hour and sent me a link to reset my password. I don't get it. If they can fix it that expeditiously, why on earth are paying customers waiting days, weeks, even months from what I have seen on these forums? I guess you have to be an absolute and utter pest like I was. It was not a fun way to spend New Year's Day, but they gave me a month of free premium (which I have yet to get any confirmation on).

If you are dealing with this same issue, my advice would be to just keep pestering. Their support needs some SERIOUS improvement.

[Oversalted]

I really need to say, i never got any Problems with Spotify. its working for Years w/o a Problem.

[mistersomebody · Accepted solution]

Hi,

I've encountered the same situation and a hacker in the wild has now my name, my email, phone number and date of birth...

I would suggested the following to allow users to react and secure our data:

• The email update notification should provide the user with a link to cancel the update
• Personal data should be protected by a security question or alike to prevent "free access" after hacking
• The user phone number should be more effectively used: 
  • 2 step authentication should be mandatory when connecting from new device or from a unusual local from user
• After a number of fail connection attempt (we have very likely been subject to brute force attack)
  • The account should be locked for a significante period of time
  • The user should be notified both by mail and sms
  • 2 step authentication should be applied in such a scenario