Spotify account email address changed without authorization

[SpotSecuritySux]

I discovered today that my Spotify account has been compromised - because I received an email informing me that the email address for the account has been changed. 

Which I did NOT authorize.

How is this even possible? The email address for an account is one of the most important aspects for security - as we all know, it's used to reset passwords, and for any communications which could (even if they shouldn't) include sensitive information.

At the very least this should require email verification to do, and really two-factor auth of some sort should be highly encouraged.

This is a pretty hideous gap in Spotify's security - and given their lackluster customer service (no phone support ?) I'm not even sure if / when I'll be able to get my account back.

[osornios]

Hey @SpotSecuritySux

The best course of action when something like that happens is to create a new account with a different email address from the one you're using (Tip: don't use the one you use for Facebook). That will give you a different Spotify username.

Once you have this new account, fill out the contact form, and someone from Spotify will be happy to help you migrate your Premium privileges, library, playlists, friends, etc. to this new account.

Also, please vote for this idea and post there so they know people would like two-factor authentication in Spotify. 🙂