What is a compromised account?
A compromised account is an account in which another person (not the Account Owner) enters in the username and password of the AO, but the account is protected by security measures (i.e. security question) so the other person is unable to gain access to the account.
How is a compromised account different from a hijacked account (ATO)?
With a compromised account, the other person (not the Account Owner) was NOT able to get into the account due to other security measures (i.e. security question) whereas with an ATO case, the other person (not the Account Owner) DID gain access to the account and the actual Account Owner may or may not have access to said account.
What does it look like when Account Security suspends a compromised account?
CSS Notes will show as:
[ACTION] Security Lockout
[DEPARTMENT] Account Security
[CAUSE] (Comp) User’s Account Is Compromised
[EVIDENCE]
[NEXT STEP] Reassign related tickets to Account Security
What does the user need to do to get resumed?
In most cases, the user only needs to update their password. If a user is reaching out to CS and the password has been updated, a ticket can be sent to “Account Security” saving the ticket as “open”. Account Security will review and resume, if appropriate. Please do not resume accounts and do wait for Account Security to do so. For urgent reviews or users that have been waiting more than a few days, please contact accountsecurity-escalations@upwork.com to let them know that a user is waiting to be resumed after updating their password.