Account hacked multiple times

[Steve-L]

Plan

Premium

Country

USA

Device

Motorola Moto g Stylus 5G / PCs

Operating System

Android 12 / Windows 10 and 11

My Question or Issue

In the last two or three months my account has been compromised three times that I am aware of. I have been using complex on duplicated from other website passwords. I knew it was happening when I repeatedly had to log back into my account on my phone several times in a couple of days. I then saw my liked song list which had been constructed over the course of several years reduced from over 200 songs to 5-10 crappy ones I've never heard of. I signed out of all sessions and changed my password only to have it happen again a couple of weeks ago and then again two days ago.  My suspicions are it's the same hacker considering it is the same b******* D&B repetitive loops with no melody each time. 

How is it 2023 and Spotify does not require or at least offer MFA?  I think this time I should probably change the email address associated with my account to increase the difficulty of this happening a fourth time. Any other advice?

[Billy-J]

Hey @Steve-L, thanks for reaching out to the Community!

I’m sorry to hear about this! In this case, I’d recommend checking out this support article for the next steps to take.
To prevent this from happening in the future, there are many measures you can take to protect your account, such as resetting your password every few months, and not using passwords you have used on other sites. There is also a great guide here for some more measures to protect your account.

If you see an email from Spotify, and can’t tell if it’s legit, use this checklist. Of course, Spotify makes sure that all user records and platforms are completely secure around the clock. In regards to two-factor authentication, Spotify is currently viewing this internally to implement this in the future. Make sure to add your vote and comments to this Live Idea.

I hope this helps.

[Steve-L]

These are all common sense things that I have already implemented and they were my personal procedures and policies already applied prior to the hack.  I was hoping for something other than the obvious.

[frightnights]

Hey Steve!

My solution would be to either change all your info (email and password). If that doesn't solve your problem, then I would make a new account and remove any subscriptions that you may have on the hacked account. 

Stay Awesome!

[Billy-J]

Hey @Steve-L, 

Thanks for the reply. On the support page that I provided, there is a way to get in touch with Customer Support to secure your account which would prevent this from happening again. I have also provided a link to some steps you can take to protect your account.

Spotify is considering implementing the two-factor authentication feature. Until then, try to follow the steps to safely close guard your account - and I will also pass your feedback on to the right teams at Spotify. 

Hope you have a great day, and let me know if you need a hand with anything else!

[sesanchez]

Plan Free

Country USA

Device iPhone 13

Operating System iOS 13

My Question or Issue
About a year ago, I tried to setup a Spotify account. Come to find out, my email was already attached to a spotify account. Dont ask me how.
Spotify was able to recover the email and gave me my account under that email. But ever since, I get reminders and suggestions for shows I'm not watching, and the playlists are still populated by artists I dont listen to.
I tried the "log out of all devices" option, which resulted in someone trying to access my email account (Thank god for double step authentication), but the notifications for shows I'm not watching continue.

How can I fully log out the other person who clearly stole my email to set up his account?  Not even mentioning HOW WAS HE ABLE TO SETUP AN ACCOUNT WITH AN EMAIL THAT IS NOT HIS?

[sesanchez]

Yeah. I tried all steps in the link you provided, which was when the other person tried to access my email.
I'm guessing he is using an XBox or something else to access the account and the "remove 3rd party" and the "logout of all devices" are not killing.

Oh well. I'll wait and see when this stops