Is it possible for a phishing website to remove or change your 2FA / email / password from your account?

[AzKat 🐔]

I'm currently talking with another user who had this happen to him, and English not being his first language it's kind of hard communicating with him.

I've already instructed him to create a steam support ticket, but while he waits for the reply from steam support (he doesn't have access to his account anymore) I'm trying to see if there's anything I can help him with.


So, long story short, I want to know if it's possible for someone to remove your 2FA authenticator, change your email and your password, without your consent.

[Kaladin]

Yes it is, happened to me few weeks ago just from clicking a single link.

[Theblaze]

Автор сообщения: AzKat

[...] So, long story short, I want to know if it's possible for someone to remove your 2FA authenticator, change your email and your password, without your consent.

Without your consent?, no.

People have to share their authentification code to a phishing site using a fake steam login for that to happen.

[cSg|mc-Hotsauce]

Have you read through Vaulty's scam guide?

You should.

[AzKat 🐔]

Автор сообщения: Theblaze

Автор сообщения: AzKat

[...] So, long story short, I want to know if it's possible for someone to remove your 2FA authenticator, change your email and your password, without your consent.

Without your consent?, no.

People have to share their authentification code to a phishing site using a fake steam login for that to happen.

Yes, but if they share their 2FA only, not their backup code, is it possible to remove the 2FA?

Автор сообщения: cSg|mc-Hotsauce

Have you read through Vaulty's scam guide?

You should.

:qr:

Do you know the answer? If you do, let me know, if you don't, thanks anyway.

[cSg|mc-Hotsauce]

It does not matter if they share the backup codes as the hijacker can just create new ones after the user gives away all his info to the fake login screen.

Go to "Fake Steam login sites!"

https://steamcommunity.com/sharedfiles/filedetails/?id=784477482

[AzKat 🐔]

Автор сообщения: cSg|mc-Hotsauce

It does not matter if they share the backup codes as the hijacker can just create new ones after the user gives away all his info to the fake login screen.

Go to "Fake Steam login sites!"

https://steamcommunity.com/sharedfiles/filedetails/?id=784477482

:qr:

But can he "remove" the original owner's access to the account? As in, he doesn't have the code generator itself, he just has 1 code which he uses over and over to access the account right?

Or is using a "one time passcode" a way to take over an account?

[cSg|mc-Hotsauce]

The hijacker could also deauthorize all devices before the account owner can do anything, yes.

[Count_Dandyman]

Автор сообщения: AzKat

Автор сообщения: cSg|mc-Hotsauce

It does not matter if they share the backup codes as the hijacker can just create new ones after the user gives away all his info to the fake login screen.

Go to "Fake Steam login sites!"

https://steamcommunity.com/sharedfiles/filedetails/?id=784477482

:qr:

But can he "remove" the original owner's access to the account? As in, he doesn't have the code generator itself, he just has 1 code which he uses over and over to access the account right?

Or is using a "one time passcode" a way to take over an account?

Instead of trying to get details about how exactly it is done which is info somebody planning to start doing it would want instead focus on avoiding giving them any access to your account at all.

[AzKat 🐔]

Автор сообщения: Count_Dandyman

Автор сообщения: AzKat

But can he "remove" the original owner's access to the account? As in, he doesn't have the code generator itself, he just has 1 code which he uses over and over to access the account right?

Or is using a "one time passcode" a way to take over an account?

Instead of trying to get details about how exactly it is done which is info somebody planning to start doing it would want instead focus on avoiding giving them any access to your account at all.

it's not my account, I've never fallen for this, that's why I ask about this.

[Count_Dandyman]

Автор сообщения: AzKat

Автор сообщения: Count_Dandyman

Instead of trying to get details about how exactly it is done which is info somebody planning to start doing it would want instead focus on avoiding giving them any access to your account at all.

it's not my account, I've never fallen for this, that's why I ask about this.

That doesn't change anything about what I said you don't need exact details and giving them out would just increase the number of people with the knowledge of how to do it all that is needed is the knowledge to prevent it which is not opening the door for them in the first place.

[AzKat 🐔]

Автор сообщения: Count_Dandyman

Автор сообщения: AzKat

it's not my account, I've never fallen for this, that's why I ask about this.

That doesn't change anything about what I said you don't need exact details and giving them out would just increase the number of people with the knowledge of how to do it all that is needed is the knowledge to prevent it which is not opening the door for them in the first place.

Right, so the guy I'm trying to help right now doesn't matter right?

[cinedine]

Автор сообщения: Theblaze

Without your consent?, no.

People have to share their authentification code to a phishing site using a fake steam login for that to happen.

If you are tricked into giving something away, it's not exactly with consent.

[Count_Dandyman]

Автор сообщения: AzKat

Автор сообщения: Count_Dandyman

That doesn't change anything about what I said you don't need exact details and giving them out would just increase the number of people with the knowledge of how to do it all that is needed is the knowledge to prevent it which is not opening the door for them in the first place.

Right, so the guy I'm trying to help right now doesn't matter right?

I never said he doesn't matter I said he doesn't need the details you are asking for

[AzKat 🐔]

Автор сообщения: Count_Dandyman

Автор сообщения: AzKat

Right, so the guy I'm trying to help right now doesn't matter right?

I never said he doesn't matter I said he doesn't need the details you are asking for

He doesn't need them, I need them.

[Count_Dandyman]

Автор сообщения: AzKat

Автор сообщения: Count_Dandyman

I never said he doesn't matter I said he doesn't need the details you are asking for

He doesn't need them, I need them.

no you don't