**Account Takeover (ATO) / Hijacked Accounts

IMPORTANT:

On top of following the process we have for handling hijacked/ATO issues detailed in the drop-downs below, IF the user has reported withdrawal of funds by the hacker, we need to ALSO ping the AS team in #ask-account-security right away. Our speed in pinging them in AS channel matters a lot on top of the ticket being escalated to them. 

Make sure to add helpful indicators about reports of hacking when reporting to AS.

Examples of helpful notes:

“USER: I am getting so many mails of invitations from upwork ?”

“Also he keeps receiving spam emails from upnotifcation3@gmail.com”

Receiving a lot of spam emails from such fake Upwork email address is a clear sign that user’s Upwork account is hacked/ATOd and the attacker is trying to bury genuine Upwork notifications inside these junk emails.

Such cases should immediately be escalated to #ask-account-security

What is an ATO account?

An ATO account is an account in which another person (not the Account Owner) has actually gained access to the AO’s account in which the actual AO may or may not have access to said account. 

How is an ATO account different from a compromised account?

With a compromised account, the other person (not the Account Owner) attempted to get in the account, but was NOT able to gain access due to other security measures (i.e. security question) whereas with an ATO case, the other person (not the Account Owner) DID gain access to the account and the actual Account Owner may or may not have access to said account.

ATO: Attacker is able to successfully log in and edit user data, apply or list jobs, etc.

Compromised Account: Attacker knows username/password but was not able to fully login to the account due to a second factor of authentication (Security question, SMS, one-time-passcode)

What is an ATO fraud charge claim?

ATO fraud charge claim - When an account has been taken over by an unauthorized party and funds were charged and/or funds were removed from the account in which the actions were not prompted by the account owner. If this is the case, see “ATO Fraud Charge Claims” dropdown.

What is a compromised email?

Compromised email -  The other person (not the owner of the email address) attempted to get in the email account. If the user believes their email account may be compromised, see “Compromised Email” dropdown.

Possible ATO 

IMPORTANT: If none of the paths showcase ATO, but the situation just doesn’t feel right, it’s highly encouraged to ping #ask-account-security channel to take a deeper look! We would much rather have a report that turns out to be nothing than to overlook a possible ATO account.

*Remember: be a detective! 

• Calls & Chats are easier since we’re chatting with the customer live and can probe for information easily. 
• For ticket cases, the more we probe back and forth via email, the more we potentially put the customer’s account at risk. 
  • If the ticket doesn’t populate BOBO, try to search OBO with first/last name, first part of email address, other info given in ticket, past tickets for unique info e.g. transaction ID, a contract number, etc. 
  • If there are no clear ATO changes within the last 2 weeks and the cust. doesn’t specify when they were able to last log in, take a look a little further back and if you can’t see anything suspicious, yet the customer states something is wrong / doesn’t feel right, reach out to #ask-account-security to be safe

If the user mentions something similar to the following, but not limited to these examples below:

• I have fraudulent charges in my Upwork account that I didn’t process
• My account is hacked OR Someone hacked my account
• Unable to access account (or email) and I didn’t make any changes to it
• Tried to reset password, but received an error that email is not associated with account
• Something weird is happening in my account that I didn’t do

• Anything related to an unknown payment / withdrawal method (for unknown methods, skip checking User Actions and go straight to the “Lock Account” drop-down to see “If an “unknown withdrawal/payment method” case”)
  • There’s a payment / withdrawal method in my account I didn’t add
  • I noticed a payment/withdrawal method I did not add but I do not see it anymore
  • I received an email saying a payment/withdrawal method was added, but I do not see it in my Upwork account

Check “User Actions” in OBO to see if any of the following changes were made in the past 2 weeks (or, since the user believes they last logged in) to their:

• Password
• Security Question Answer
• Email Address
• Registered Email Address (while we won’t see changes / time stamps here, this can be a good piece of info to look at if claims of email changes occurred)

• If YES, this is a possible ATO, go to "Lock Account & Send to Account Security" dropdown for additional information.
• If NO, and user does NOT qualify as possible ATO where they state they are having trouble getting in their account, see: **User Login Trouble
• If NO, and user does NOT qualify as possible ATO where they claim an unauthorized/fraudulent charge, see: **Handling Unauthorized / Fraudulent Charge Reports