So TNT is actively resetting passwords again

[Mophead]

They acknowledged this somewhat in an editorial post ([Only registered and activated users can see links]) recently.


[Only registered and activated users can see links]
Hi there this is a great question! So it is legit do not fret! This is a message from our official neopets email. Support only handles individual ticket responses for account issues. This is just an automated email to ensure the safety of your account when your password has not been reset in a long while.

While I don't really care for them sending out emails about passwords getting reset, I did notice a lot of people complaining about passwords for their accounts being reset so I figured I'd look into it a lil bit.

I've done some testing with this to see what's happening and in short there is no rhyme or reason from what I can see.

I've tried A LOT of different things including. These are all things I've tested to see if passwords get reset:

- Signing into inactive, unlogged accounts without changing the password.
- Signing into inactive unlogged accounts and changing the password immediately.
- Signing into inactive accounts, doing some dailies, and then changing the password.
- Signing into secured inactive accounts and changing the password.
- Signing into inactive accounts without pets/accounts that aren't activated and exiting immediately.
- Signing into inactive accounts on a standard VPN.
- Signing into inactive accounts with private proxies.
- Signing into inactive accounts with rotating residential proxies.
- Signing into inactive accounts on my home IP.
- Signing into inactive accounts and loading items onto them.
- Signing into inactive accounts and moving items off of them.


All of these lead to an account having it's password reset. It didn't matter if I did the accounts in alphabetical order or if I signed into them randomly without the accounts being remotely close in spelling.

It's worth noting that I didn't test anything on active accounts for obvious reasons. It's also worth noting that signing into accounts that I have secured over the years did not lead to accounts getting password reset.

I don't actively raid accounts anymore, nor do I really plan on doing anything further with what TNT is doing or what I've found. I did want to share my findings since I know a lot of people still do stuff like this.

tl;dr if you're moving stuff around only send it to accounts that you've had secured for a long time.
If anyone else looks into this and finds somethin' noteworthy feel free to post it up. :)

[gera]

Thank you for this info. I’ve been meaning to ask this question and when I tried searching via the search bar, there wasn’t really an answer, just seller threads.

But can you or someone please clarify what is a secured account?

I see the phrase pop up a lot in the trades section and when talking about shells/moving your np, items, pets.

Again, sorry if this is a stupid question but I haven’t done anything illegit, yet.. and would like to take my time understanding all processes.

[Shiro]

Secured account - person has access to the email the account is on and is the current owner.

Active - seen less than 360 days ago. Too risky and you may end up getting you and your buyer frozen.

Inactive - seen a long long time ago. Hard with Stealth accounts though. Often pets are unfed, no new items and no new trophies

[Mophead]

Thank you for this info. I’ve been meaning to ask this question and when I tried searching via the search bar, there wasn’t really an answer, just seller threads.

But can you or someone please clarify what is a secured account?

I see the phrase pop up a lot in the trades section and when talking about shells/moving your np, items, pets.

Again, sorry if this is a stupid question but I haven’t done anything illegit, yet.. and would like to take my time understanding all processes.

A secured account is when an account has it's password/PIN secured.
People will ignore the email a very large majority of the time unless the account was unreg before it was secured.

And an unreg account is just an account that was secured by recreating the email that was tied to an account and resetting the password through the password reset.

[Cybun]

Well, ain't that peachy. Guess I gotta flood em with tickets to recover inactives again since that's what they're setting themselves up for

[Fiore]

Thanks for this! I've been checking in on stuff semi-actively but a while back I did get a PW reset on an active account that I created.

To those who buy/raid: Keep a record of any emails and PWs and make sure your accounts are secured! Make sure you're able to login to any emails your accounts are tied to in case you get hit with a reset.

[Shiro]

Also:
Keep a record of the location where the account was created and the address.

US - state, city + address
Everywhere else - location, city + address.

Yes.
They are now asking for addresses that are on the account.

Tony P WILL NOT help you if you don't have the original email

Alice.w will ask a ton of questions.

Lucille is no longer doing password requests

[I_royalty_I]

I guess activity isn’t low enough for them right now eh?

[j03]

Sorry, but people have been reporting this topic... Your post is fearmongering. While there are resets going out, these "tests" are random and everything that you've tested has not happened to others doing the same things (ie, loading items onto shells for sale, immediately changing the password, etc). This is just causing people to be scared of purchasing or selling, or giving them a reason to claim bad password on something that works fine in order to scam.

We should stop shedding light on account hijacking - especially in any way that helps people secure stolen accounts. It's 2019, not 2009. :S