Turn on MFA Before Crooks Do It For You
Summary: A career chief privacy officer's son lost access to his Xbox account after reusing his password and skipping multi-factor authentication, and the attackers then enabled MFA tied to a Gmail address they controlled. Microsoft refused to reset the password even after the family answered all 20 account-recovery questions, citing a policy against turning over accounts to someone who could not provide the second factor, until the case was escalated to Tier 3 Support.
Bottom line: The recovery codes the family had stored in a safe were rendered useless the moment the attacker turned on MFA, and the thieves drew down the son's bank account through game purchases on Xbox and Electronic Arts while the account stayed locked.
Read the original at Krebs on Security ↗
- Topics
- Identity & Access Management
- Related
- FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026Sponsored: Specter Ops on the impact of AI agents on Blood Hound Cyber Risks · Sep 20, 2026