Today I got an email from "online.communications@alerts.comcast.net".
Here is a cut and paste of the essence of the service order:

"Your updated service order is confirmed."

"PENTHOUSE $19.99
HUSTLER On Demand $19.99
Cinemax $12.00"

I never made any changes to my account, and the only one authorized to
make changes such as odering a movie or adding features, is me, Boris.
And I've not even ever done that.

When I finally managed to get out of robot menu hell, and got a live
person, Shylo (or Shilo?) cancelled the charges. Shylo told me that my
account showed that the only persons authorized to make changes were
Boris Mylastname, and Ruth Mylastname. Huh? There is no Ruth
Mylastname. Someone, somehow, was able to add Ruth Mylastname.

Now, the Comcast account is for my second home, which I rent out for
short term rentals through AirB&B and VRBO. The home currently has
renters for three days, and the charge began the day after they checked
in. They are lawyers celebrating passing the bar. They do know my first
and lastname, but that's all.

Not only did Shylo cancel the charges, She also took "Ruth" off the
authorized list, such that only Boris Mylastname was again the only
person authorized to make changes to the account.

I still wonder about two things:

1) In order to accomplish what was done, the 'thief' has to act as Boris
and authorize "Ruth" to make changes. To prove you're Boris, you have to
know Boris's last four S.S. digits, or something only Boris would know.

2) Even though Shylo said she'd change the account authorizations back to
where only Boris could make changes, seems like the same person could
just do it again, if they have Boris's 'information', whatever that is.

I did call the renters before I called Comcast, and told them of the
charges, and asked did they know anything about it. So far, they have
not called back.

I also had the TVs in the home locked with a PIN prohibiting changes with
Comcast.

Any idea how this happened? The renters? Not the renters, but someone
else who hacked in? It is awful coincidental. Perhaps the renters
called Comcast and said, "I'm Boris Mylastname, and I want to authorize
my wife/sister/daughter Ruth Mylastname to make changes to my account,
and Comcast was lazy about asking for proof it was me, Boris, authorizing
"Ruth". They do know my full name (maybe more?) BTW, I have no social
media accounts, none.

I'm afraid this may happen again by the same culprits.

Comments and ideas are appreciated.

TIA

On 5/17/21 12:30 AM, Boris wrote:
> Today I got an email from "online.communications@alerts.comcast.net".
> Here is a cut and paste of the essence of the service order:
>
> "Your updated service order is confirmed."
>
> "PENTHOUSE $19.99
> HUSTLER On Demand $19.99
> Cinemax $12.00"
>
>

Subscribe to all Comcast TV packages and include the cost in the house rental fee.

On 5/17/2021 12:30 AM, Boris wrote:
> Today I got an email from "online.communications@alerts.comcast.net".
> Here is a cut and paste of the essence of the service order:
>
> "Your updated service order is confirmed."
>
> "PENTHOUSE $19.99
> HUSTLER On Demand $19.99
> Cinemax $12.00"
>
> I never made any changes to my account, and the only one authorized to
> make changes such as odering a movie or adding features, is me, Boris.
> And I've not even ever done that.
>
> When I finally managed to get out of robot menu hell, and got a live
> person, Shylo (or Shilo?) cancelled the charges. Shylo told me that my
> account showed that the only persons authorized to make changes were
> Boris Mylastname, and Ruth Mylastname. Huh? There is no Ruth
> Mylastname. Someone, somehow, was able to add Ruth Mylastname.
>
> Now, the Comcast account is for my second home, which I rent out for
> short term rentals through AirB&B and VRBO. The home currently has
> renters for three days, and the charge began the day after they checked
> in. They are lawyers celebrating passing the bar. They do know my first
> and lastname, but that's all.
>
> Not only did Shylo cancel the charges, She also took "Ruth" off the
> authorized list, such that only Boris Mylastname was again the only
> person authorized to make changes to the account.
>
> I still wonder about two things:
>
> 1) In order to accomplish what was done, the 'thief' has to act as Boris
> and authorize "Ruth" to make changes. To prove you're Boris, you have to
> know Boris's last four S.S. digits, or something only Boris would know.
>
> 2) Even though Shylo said she'd change the account authorizations back to
> where only Boris could make changes, seems like the same person could
> just do it again, if they have Boris's 'information', whatever that is.
>
> I did call the renters before I called Comcast, and told them of the
> charges, and asked did they know anything about it. So far, they have
> not called back.
>
> I also had the TVs in the home locked with a PIN prohibiting changes with
> Comcast.
>
> Any idea how this happened? The renters? Not the renters, but someone
> else who hacked in? It is awful coincidental. Perhaps the renters
> called Comcast and said, "I'm Boris Mylastname, and I want to authorize
> my wife/sister/daughter Ruth Mylastname to make changes to my account,
> and Comcast was lazy about asking for proof it was me, Boris, authorizing
> "Ruth". They do know my full name (maybe more?) BTW, I have no social
> media accounts, none.
>
> I'm afraid this may happen again by the same culprits.
>
> Comments and ideas are appreciated.
>
> TIA
>

No ideas about how it happened that would be any more than speculation.
However, you can set a purchase PIN that should preclude a recurrence.
Just make sure that you choose a PIN that is different than the last 4
digits of your SSN! See:
https://www.xfinity.com/support/articles/x1-parental-controls-turn-puchase-protection-on-off

Boris <Boris@invalid.invalid> wrote:

>Today I got an email from "online.communications@alerts.comcast.net".
>Here is a cut and paste of the essence of the service order:

Wow. That's quite a scam.

Take your documentation of the call to Comcast and file a police report.
There's simply no way this wasn't criminal activity.

Retirednoguilt <HapilyRetired@fakeaddress.com> wrote in
news:s7tlgk$kr4$1@dont-email.me:

> On 5/17/2021 12:30 AM, Boris wrote:
>> Today I got an email from "online.communications@alerts.comcast.net".
>> Here is a cut and paste of the essence of the service order:
>>
>> "Your updated service order is confirmed."
>>
>> "PENTHOUSE $19.99
>> HUSTLER On Demand $19.99
>> Cinemax $12.00"
>>
>> I never made any changes to my account, and the only one authorized
>> to make changes such as odering a movie or adding features, is me,
>> Boris. And I've not even ever done that.
>>
>> When I finally managed to get out of robot menu hell, and got a live
>> person, Shylo (or Shilo?) cancelled the charges. Shylo told me that
>> my account showed that the only persons authorized to make changes
>> were Boris Mylastname, and Ruth Mylastname. Huh? There is no Ruth
>> Mylastname. Someone, somehow, was able to add Ruth Mylastname.
>>
>> Now, the Comcast account is for my second home, which I rent out for
>> short term rentals through AirB&B and VRBO. The home currently has
>> renters for three days, and the charge began the day after they
>> checked in. They are lawyers celebrating passing the bar. They do
>> know my first and lastname, but that's all.
>>
>> Not only did Shylo cancel the charges, She also took "Ruth" off the
>> authorized list, such that only Boris Mylastname was again the only
>> person authorized to make changes to the account.
>>
>> I still wonder about two things:
>>
>> 1) In order to accomplish what was done, the 'thief' has to act as
>> Boris and authorize "Ruth" to make changes. To prove you're Boris,
>> you have to know Boris's last four S.S. digits, or something only
>> Boris would know.
>>
>> 2) Even though Shylo said she'd change the account authorizations
>> back to where only Boris could make changes, seems like the same
>> person could just do it again, if they have Boris's 'information',
>> whatever that is.
>>
>> I did call the renters before I called Comcast, and told them of the
>> charges, and asked did they know anything about it. So far, they
>> have not called back.
>>
>> I also had the TVs in the home locked with a PIN prohibiting changes
>> with Comcast.
>>
>> Any idea how this happened? The renters? Not the renters, but
>> someone else who hacked in? It is awful coincidental. Perhaps the
>> renters called Comcast and said, "I'm Boris Mylastname, and I want to
>> authorize my wife/sister/daughter Ruth Mylastname to make changes to
>> my account, and Comcast was lazy about asking for proof it was me,
>> Boris, authorizing "Ruth". They do know my full name (maybe more?)
>> BTW, I have no social media accounts, none.
>>
>> I'm afraid this may happen again by the same culprits.
>>
>> Comments and ideas are appreciated.
>>
>> TIA
>>
>
> No ideas about how it happened that would be any more than
> speculation.
> However, you can set a purchase PIN that should preclude a
> recurrence. Just make sure that you choose a PIN that is different
> than the last 4
> digits of your SSN! See:
> https://www.xfinity.com/support/articles/x1-parental-controls-turn-puch
> ase-protection-on-off
>
>
>

I said in my post that a PIN had been set long ago.

"Adam H. Kerman" <ahk@chinet.com> wrote in news:s7ttmv$o6m$2@dont-email.me:

> Boris <Boris@invalid.invalid> wrote:
>
>>Today I got an email from "online.communications@alerts.comcast.net".
>>Here is a cut and paste of the essence of the service order:
>
> Wow. That's quite a scam.
>
> Take your documentation of the call to Comcast and file a police report.
> There's simply no way this wasn't criminal activity.
>

Hi, Adam,

I've dealt with the cops due to a burglary four years ago. The burglars
left forensic evidence ALL over the place and I had to TELL the cops to
take it with them. They did, but their report simply said Burglary at such
and such an address. I knew they wouldn't care, but I had to report for
insurance purposes.

Boris <Boris@invalid.invalid> wrote:
>Adam H. Kerman <ahk@chinet.com> wrote:
>>Boris <Boris@invalid.invalid> wrote:

>>>Today I got an email from "online.communications@alerts.comcast.net".
>>>Here is a cut and paste of the essence of the service order:

>>Wow. That's quite a scam.

>>Take your documentation of the call to Comcast and file a police report.
>>There's simply no way this wasn't criminal activity.

>I've dealt with the cops due to a burglary four years ago. The burglars
>left forensic evidence ALL over the place and I had to TELL the cops to
>take it with them. They did, but their report simply said Burglary at such
>and such an address. I knew they wouldn't care, but I had to report for
>insurance purposes.

I'm sorry they refused to help you last time.

With a police report number on the record, you might call Comcast back
and let them know that you reported this AND you expect them to fix
their billing system so your account doesn't get compromised again. Then
ask for a large credit on your account. Comcast hates giving credits to
subscribers and that might get the attention of a higher up.

Speak to the Comcast liason at your village hall and have that person
refer you to a Comcast subscriber service representative who has more
authority.

This is disturbing. My guess is that the owner of the pr0n service
submitted a lot of names to Comcast claiming they ordered.

A long time ago, when I was an AT&T subscriber, my account was both
slammed and crammed thanks to federal rules allowing ANY billing entity
to submit bills to AT&T's billing system (cramming) and AT&T itself
putting unauthorized pre-paid long distance services on the bill
(slamming). That took a long time to fix. One advantage of cable was
that their subscriber billing systems weren't open to fraud like this
but your experience demonstrates that that's no longer the case.

On 5/17/2021 11:47 AM, Boris wrote:
> Retirednoguilt <HapilyRetired@fakeaddress.com> wrote in
> news:s7tlgk$kr4$1@dont-email.me:
>
>> On 5/17/2021 12:30 AM, Boris wrote:
>>> Today I got an email from "online.communications@alerts.comcast.net".
>>> Here is a cut and paste of the essence of the service order:
>>>
>>> "Your updated service order is confirmed."
>>>
>>> "PENTHOUSE $19.99
>>> HUSTLER On Demand $19.99
>>> Cinemax $12.00"
>>>
>>> I never made any changes to my account, and the only one authorized
>>> to make changes such as odering a movie or adding features, is me,
>>> Boris. And I've not even ever done that.
>>>
>>> When I finally managed to get out of robot menu hell, and got a live
>>> person, Shylo (or Shilo?) cancelled the charges. Shylo told me that
>>> my account showed that the only persons authorized to make changes
>>> were Boris Mylastname, and Ruth Mylastname. Huh? There is no Ruth
>>> Mylastname. Someone, somehow, was able to add Ruth Mylastname.
>>>
>>> Now, the Comcast account is for my second home, which I rent out for
>>> short term rentals through AirB&B and VRBO. The home currently has
>>> renters for three days, and the charge began the day after they
>>> checked in. They are lawyers celebrating passing the bar. They do
>>> know my first and lastname, but that's all.
>>>
>>> Not only did Shylo cancel the charges, She also took "Ruth" off the
>>> authorized list, such that only Boris Mylastname was again the only
>>> person authorized to make changes to the account.
>>>
>>> I still wonder about two things:
>>>
>>> 1) In order to accomplish what was done, the 'thief' has to act as
>>> Boris and authorize "Ruth" to make changes. To prove you're Boris,
>>> you have to know Boris's last four S.S. digits, or something only
>>> Boris would know.
>>>
>>> 2) Even though Shylo said she'd change the account authorizations
>>> back to where only Boris could make changes, seems like the same
>>> person could just do it again, if they have Boris's 'information',
>>> whatever that is.
>>>
>>> I did call the renters before I called Comcast, and told them of the
>>> charges, and asked did they know anything about it. So far, they
>>> have not called back.
>>>
>>> I also had the TVs in the home locked with a PIN prohibiting changes
>>> with Comcast.
>>>
>>> Any idea how this happened? The renters? Not the renters, but
>>> someone else who hacked in? It is awful coincidental. Perhaps the
>>> renters called Comcast and said, "I'm Boris Mylastname, and I want to
>>> authorize my wife/sister/daughter Ruth Mylastname to make changes to
>>> my account, and Comcast was lazy about asking for proof it was me,
>>> Boris, authorizing "Ruth". They do know my full name (maybe more?)
>>> BTW, I have no social media accounts, none.
>>>
>>> I'm afraid this may happen again by the same culprits.
>>>
>>> Comments and ideas are appreciated.
>>>
>>> TIA
>>>
>>
>> No ideas about how it happened that would be any more than
>> speculation.
>> However, you can set a purchase PIN that should preclude a
>> recurrence. Just make sure that you choose a PIN that is different
>> than the last 4
>> digits of your SSN! See:
>> https://www.xfinity.com/support/articles/x1-parental-controls-turn-puch
>> ase-protection-on-off
>>
>>
>>
>
> I said in my post that a PIN had been set long ago.
>

I read what you had said. Please note the following text that appears
on the xfinity web page of the link I previously included (did you read
it?):

"Set Locks for Purchased Programs

A four-digit Purchase Personal Identification Number (Purchase PIN) can
also be set to restrict unauthorized orders of Xfinity On Demand
programs and pay per view events. Note: This PIN is different from the
Locks PIN."

You wrote, "I also had the TV's in the home locked with a PIN
prohibiting changes with Comcast."

You made it sound as though you had added a Locks PIN to your account.
My suggestion was to add a Purchase PIN. Leave it to Comcast to have
two different PINs having two different functions be easily confused or
conflated with each other. In other words, verify that you had set a
Purchase PIN in addition to a Lock PIN.

Retirednoguilt <HapilyRetired@fakeaddress.com> wrote in
news:s7ud3v$5f8$1@dont-email.me:

> On 5/17/2021 11:47 AM, Boris wrote:
>> Retirednoguilt <HapilyRetired@fakeaddress.com> wrote in
>> news:s7tlgk$kr4$1@dont-email.me:
>>
>>> On 5/17/2021 12:30 AM, Boris wrote:
>>>> Today I got an email from "online.communications@alerts.comcast.net".
>>>> Here is a cut and paste of the essence of the service order:
>>>>
>>>> "Your updated service order is confirmed."
>>>>
>>>> "PENTHOUSE $19.99
>>>> HUSTLER On Demand $19.99
>>>> Cinemax $12.00"
>>>>
>>>> I never made any changes to my account, and the only one authorized
>>>> to make changes such as odering a movie or adding features, is me,
>>>> Boris. And I've not even ever done that.
>>>>
>>>> When I finally managed to get out of robot menu hell, and got a live
>>>> person, Shylo (or Shilo?) cancelled the charges. Shylo told me that
>>>> my account showed that the only persons authorized to make changes
>>>> were Boris Mylastname, and Ruth Mylastname. Huh? There is no Ruth
>>>> Mylastname. Someone, somehow, was able to add Ruth Mylastname.
>>>>
>>>> Now, the Comcast account is for my second home, which I rent out for
>>>> short term rentals through AirB&B and VRBO. The home currently has
>>>> renters for three days, and the charge began the day after they
>>>> checked in. They are lawyers celebrating passing the bar. They do
>>>> know my first and lastname, but that's all.
>>>>
>>>> Not only did Shylo cancel the charges, She also took "Ruth" off the
>>>> authorized list, such that only Boris Mylastname was again the only
>>>> person authorized to make changes to the account.
>>>>
>>>> I still wonder about two things:
>>>>
>>>> 1) In order to accomplish what was done, the 'thief' has to act as
>>>> Boris and authorize "Ruth" to make changes. To prove you're Boris,
>>>> you have to know Boris's last four S.S. digits, or something only
>>>> Boris would know.
>>>>
>>>> 2) Even though Shylo said she'd change the account authorizations
>>>> back to where only Boris could make changes, seems like the same
>>>> person could just do it again, if they have Boris's 'information',
>>>> whatever that is.
>>>>
>>>> I did call the renters before I called Comcast, and told them of the
>>>> charges, and asked did they know anything about it. So far, they
>>>> have not called back.
>>>>
>>>> I also had the TVs in the home locked with a PIN prohibiting changes
>>>> with Comcast.
>>>>
>>>> Any idea how this happened? The renters? Not the renters, but
>>>> someone else who hacked in? It is awful coincidental. Perhaps the
>>>> renters called Comcast and said, "I'm Boris Mylastname, and I want to
>>>> authorize my wife/sister/daughter Ruth Mylastname to make changes to
>>>> my account, and Comcast was lazy about asking for proof it was me,
>>>> Boris, authorizing "Ruth". They do know my full name (maybe more?)
>>>> BTW, I have no social media accounts, none.
>>>>
>>>> I'm afraid this may happen again by the same culprits.
>>>>
>>>> Comments and ideas are appreciated.
>>>>
>>>> TIA
>>>>
>>>
>>> No ideas about how it happened that would be any more than
>>> speculation.
>>> However, you can set a purchase PIN that should preclude a
>>> recurrence. Just make sure that you choose a PIN that is different
>>> than the last 4
>>> digits of your SSN! See:
>>> https://www.xfinity.com/support/articles/x1-parental-controls-turn-
puch
>>> ase-protection-on-off
>>>
>>>
>>>
>>
>> I said in my post that a PIN had been set long ago.
>>
>
> I read what you had said. Please note the following text that appears
> on the xfinity web page of the link I previously included (did you read
> it?):
>
> "Set Locks for Purchased Programs
>
> A four-digit Purchase Personal Identification Number (Purchase PIN) can
> also be set to restrict unauthorized orders of Xfinity On Demand
> programs and pay per view events. Note: This PIN is different from the
> Locks PIN."
>
> You wrote, "I also had the TV's in the home locked with a PIN
> prohibiting changes with Comcast."
>
> You made it sound as though you had added a Locks PIN to your account.
> My suggestion was to add a Purchase PIN. Leave it to Comcast to have
> two different PINs having two different functions be easily confused or
> conflated with each other. In other words, verify that you had set a
> Purchase PIN in addition to a Lock PIN.
>

Thanks for that clarification. I only had a purchase PIN, because when I
spoke with Comcast years ago to set up a 'PIN', I was not told there were
two types. Maybe there was only a purchase PIN then. You are right, leave
it to Comcast to have complicated set ups. .

However, Comcast told me that the thief called in to put themself on the
authorized user list. Neither a lock nor a purchase PIN was violated.

Boris <nospam@nospam.invalid> wrote:
>Retirednoguilt <HapilyRetired@fakeaddress.com> wrote:
>>On 5/17/2021 11:47 AM, Boris wrote:

>>>I said in my post that a PIN had been set long ago.

>>I read what you had said. Please note the following text that appears
>>on the xfinity web page of the link I previously included (did you read
>>it?):

>>"Set Locks for Purchased Programs

>>A four-digit Purchase Personal Identification Number (Purchase PIN) can
>>also be set to restrict unauthorized orders of Xfinity On Demand
>>programs and pay per view events. Note: This PIN is different from the
>>Locks PIN."

>>You wrote, "I also had the TV's in the home locked with a PIN
>>prohibiting changes with Comcast."

>>You made it sound as though you had added a Locks PIN to your account.
>>My suggestion was to add a Purchase PIN. Leave it to Comcast to have
>>two different PINs having two different functions be easily confused or
>>conflated with each other. In other words, verify that you had set a
>>Purchase PIN in addition to a Lock PIN.

>Thanks for that clarification. I only had a purchase PIN, because when I
>spoke with Comcast years ago to set up a 'PIN', I was not told there were
>two types. Maybe there was only a purchase PIN then. You are right, leave
>it to Comcast to have complicated set ups. .

>However, Comcast told me that the thief called in to put themself on the
>authorized user list. Neither a lock nor a purchase PIN was violated.

Wow. Kind of defeats the purpose of the purchase PIN.

Surely this can be tied to an individual as he must be doing it to earn
commission.

On 5/18/2021 9:52 AM, Adam H. Kerman wrote:
> Boris <nospam@nospam.invalid> wrote:
>> Retirednoguilt <HapilyRetired@fakeaddress.com> wrote:
>>> On 5/17/2021 11:47 AM, Boris wrote:
>
>>>> I said in my post that a PIN had been set long ago.
>
>>> I read what you had said. Please note the following text that appears
>>> on the xfinity web page of the link I previously included (did you read
>>> it?):
>
>>> "Set Locks for Purchased Programs
>
>>> A four-digit Purchase Personal Identification Number (Purchase PIN) can
>>> also be set to restrict unauthorized orders of Xfinity On Demand
>>> programs and pay per view events. Note: This PIN is different from the
>>> Locks PIN."
>
>>> You wrote, "I also had the TV's in the home locked with a PIN
>>> prohibiting changes with Comcast."
>
>>> You made it sound as though you had added a Locks PIN to your account.
>>> My suggestion was to add a Purchase PIN. Leave it to Comcast to have
>>> two different PINs having two different functions be easily confused or
>>> conflated with each other. In other words, verify that you had set a
>>> Purchase PIN in addition to a Lock PIN.
>
>> Thanks for that clarification. I only had a purchase PIN, because when I
>> spoke with Comcast years ago to set up a 'PIN', I was not told there were
>> two types. Maybe there was only a purchase PIN then. You are right, leave
>> it to Comcast to have complicated set ups. .
>
>> However, Comcast told me that the thief called in to put themself on the
>> authorized user list. Neither a lock nor a purchase PIN was violated.
>
> Wow. Kind of defeats the purpose of the purchase PIN.
>
> Surely this can be tied to an individual as he must be doing it to earn
> commission.
>

Agree. Seems Comcast should require more identifying data from the
supposed authorized user seeking to add a new user, such as the last 4
digits of the bank account used for autopayment of monthly bills, the
balance due on the bill from several months before, 2 factor
authorization using the account's initial user's e-mail of record on the
account, or other data that was required by Comcast when they originally
established the account that would not likely be known by the imposter.
Of course, Comcast makes money if they allow imposters to run up
charges whether validly ordered or not; so they have no incentive to
tighten security.

On 5/18/21 11:01 AM, this is what Retirednoguilt wrote:
> On 5/18/2021 9:52 AM, Adam H. Kerman wrote:
>> Boris <nospam@nospam.invalid> wrote:
>>> Retirednoguilt <HapilyRetired@fakeaddress.com> wrote:
>>>> On 5/17/2021 11:47 AM, Boris wrote:
>>
>>>>> I said in my post that a PIN had been set long ago.
>>
>>>> I read what you had said.  Please note the following text that appears
>>>> on the xfinity web page of the link I previously included (did you read
>>>> it?):
>>
>>>> "Set Locks for Purchased Programs
>>
>>>> A four-digit Purchase Personal Identification Number (Purchase PIN) can
>>>> also be set to restrict unauthorized orders of Xfinity On Demand
>>>> programs and pay per view events. Note: This PIN is different from the
>>>> Locks PIN."
>>
>>>> You wrote, "I also had the TV's in the home locked with a PIN
>>>> prohibiting changes with Comcast."
>>
>>>> You made it sound as though you had added a Locks PIN to your account.
>>>> My suggestion was to add a Purchase PIN.  Leave it to Comcast to have
>>>> two different PINs having two different functions be easily confused or
>>>> conflated with each other.  In other words, verify that you had set a
>>>> Purchase PIN in addition to a Lock PIN.
>>
>>> Thanks for that clarification. I only had a purchase PIN, because when I
>>> spoke with Comcast years ago to set up a 'PIN', I was not told there were
>>> two types.  Maybe there was only a purchase PIN then. You are right, leave
>>> it to Comcast to have complicated set ups. .
>>
>>> However, Comcast told me that the thief called in to put themself on the
>>> authorized user list.  Neither a lock nor a purchase PIN was violated.
>>
>> Wow. Kind of defeats the purpose of the purchase PIN.
>>
>> Surely this can be tied to an individual as he must be doing it to earn
>> commission.
>>
>
> Agree.  Seems Comcast should require more identifying data from the supposed authorized user seeking to add a new user, such as the last 4
> digits of the bank account used for autopayment of monthly bills, the balance due on the bill from several months before, 2 factor
> authorization using the account's initial user's e-mail of record on the account, or other data that was required by Comcast when they
> originally established the account that would not likely be known by the imposter.  Of course, Comcast makes money if they allow imposters
> to run up charges whether validly ordered or not; so they have no incentive to tighten security.

It takes more time for all that and simply asking for a PIN is easy and fast. Time is money to a business.

--
Linux Mint Cinnamon 20.1 64bit, Dell Inspiron 5570 laptop
Quad Core i7-8550U, 16G Memory, 512G SSD, 750G & 1TB HDDs
*I collect teddy bears.

On 5/18/2021 10:16 AM, Teddy-Bears wrote:
> On 5/18/21 11:01 AM, this is what Retirednoguilt wrote:

<snipsnipsnip>

>>
>> Agree.  Seems Comcast should require more identifying data from the
>> supposed authorized user seeking to add a new user, such as the last 4
>> digits of the bank account used for autopayment of monthly bills, the
>> balance due on the bill from several months before, 2 factor
>> authorization using the account's initial user's e-mail of record on
>> the account, or other data that was required by Comcast when they
>> originally established the account that would not likely be known by
>> the imposter.  Of course, Comcast makes money if they allow imposters
>> to run up charges whether validly ordered or not; so they have no
>> incentive to tighten security.
>
> It takes more time for all that and simply asking for a PIN is easy and
> fast.  Time is money to a business.
>
>

And we all know Comcast is all about the almighty dollar. Customers be
damned...

"Adam H. Kerman" <ahk@chinet.com> wrote in
news:s7uavk$i7f$1@dont-email.me:

> Boris <Boris@invalid.invalid> wrote:
>>Adam H. Kerman <ahk@chinet.com> wrote:
>>>Boris <Boris@invalid.invalid> wrote:
>
>>>>Today I got an email from "online.communications@alerts.comcast.net".
>>>>Here is a cut and paste of the essence of the service order:
>
>>>Wow. That's quite a scam.
>
>>>Take your documentation of the call to Comcast and file a police
>>>report. There's simply no way this wasn't criminal activity.
>
>>I've dealt with the cops due to a burglary four years ago. The burglars
>>left forensic evidence ALL over the place and I had to TELL the cops to
>>take it with them. They did, but their report simply said Burglary at
>>such and such an address. I knew they wouldn't care, but I had to
>>report for insurance purposes.
>
> I'm sorry they refused to help you last time.
>
> With a police report number on the record, you might call Comcast back
> and let them know that you reported this AND you expect them to fix
> their billing system so your account doesn't get compromised again. Then
> ask for a large credit on your account. Comcast hates giving credits to
> subscribers and that might get the attention of a higher up.
>
> Speak to the Comcast liason at your village hall and have that person
> refer you to a Comcast subscriber service representative who has more
> authority.
>
> This is disturbing. My guess is that the owner of the pr0n service
> submitted a lot of names to Comcast claiming they ordered.
>
> A long time ago, when I was an AT&T subscriber, my account was both
> slammed and crammed thanks to federal rules allowing ANY billing entity
> to submit bills to AT&T's billing system (cramming) and AT&T itself
> putting unauthorized pre-paid long distance services on the bill
> (slamming). That took a long time to fix. One advantage of cable was
> that their subscriber billing systems weren't open to fraud like this
> but your experience demonstrates that that's no longer the case.

About 1 1/2 years ago, immediatey after upgrading and plugging in all of
the X1 stuff, I had volume issues on every X1 connected TV. This was in
my own home. After having three techs come out and bungle their so-called
fixes (details too long to describe), I still had volume issues. I had
even created a 3-page detailed schematic, color-coded, layout of all 70
components, with the complete specs of each, with the routing to all
rooms. They actually broke the demarc box outside, and left without
fixing it.

I contacted our city manager, who gave me the city's Comcast manager. I
called him, and he and his outside line tech came out together to meet me.
The outside line that serves the block was checked and found to be ok.
The problem was caused by an old coax line. They replaced that line, and
all was well. They also left me with a 1,000' spool of coax in case I
wanted to rewire the entire home, but that was not necessary. If only one
of the first three techs had really looked at my schematic, they would
have spotted the old RJ59 coax.

Retirednoguilt <HapilyRetired@fakeaddress.com> wrote in news:s80krm$8fs$1
@dont-email.me:

> On 5/18/2021 9:52 AM, Adam H. Kerman wrote:
>> Boris <nospam@nospam.invalid> wrote:
>>> Retirednoguilt <HapilyRetired@fakeaddress.com> wrote:
>>>> On 5/17/2021 11:47 AM, Boris wrote:
>>
>>>>> I said in my post that a PIN had been set long ago.
>>
>>>> I read what you had said. Please note the following text that
appears
>>>> on the xfinity web page of the link I previously included (did you
read
>>>> it?):
>>
>>>> "Set Locks for Purchased Programs
>>
>>>> A four-digit Purchase Personal Identification Number (Purchase PIN)
can
>>>> also be set to restrict unauthorized orders of Xfinity On Demand
>>>> programs and pay per view events. Note: This PIN is different from
the
>>>> Locks PIN."
>>
>>>> You wrote, "I also had the TV's in the home locked with a PIN
>>>> prohibiting changes with Comcast."
>>
>>>> You made it sound as though you had added a Locks PIN to your
account.
>>>> My suggestion was to add a Purchase PIN. Leave it to Comcast to have
>>>> two different PINs having two different functions be easily confused
or
>>>> conflated with each other. In other words, verify that you had set a
>>>> Purchase PIN in addition to a Lock PIN.
>>
>>> Thanks for that clarification. I only had a purchase PIN, because when
I >>> spoke with Comcast years ago to set up a 'PIN', I was not told there
were
>>> two types. Maybe there was only a purchase PIN then. You are right,
leave
>>> it to Comcast to have complicated set ups. .
>>
>>> However, Comcast told me that the thief called in to put themself on
the
>>> authorized user list. Neither a lock nor a purchase PIN was violated.
>>
>> Wow. Kind of defeats the purpose of the purchase PIN.
>>
>> Surely this can be tied to an individual as he must be doing it to earn
>> commission.
>>
>
> Agree. Seems Comcast should require more identifying data from the
> supposed authorized user seeking to add a new user, such as the last 4
> digits of the bank account used for autopayment of monthly bills, the
> balance due on the bill from several months before, 2 factor
> authorization using the account's initial user's e-mail of record on the
> account, or other data that was required by Comcast when they originally
> established the account that would not likely be known by the imposter.
> Of course, Comcast makes money if they allow imposters to run up
> charges whether validly ordered or not; so they have no incentive to
> tighten security.

Yes, indeed.

leonard hofstatder <n.nut@comcast.net> wrote in news:s817fq$mr4$1@dont-
email.me:

> On 5/18/2021 10:16 AM, Teddy-Bears wrote:
>> On 5/18/21 11:01 AM, this is what Retirednoguilt wrote:
>
> <snipsnipsnip>
>
>
>>>
>>> Agree.  Seems Comcast should require more identifying data from the
>>> supposed authorized user seeking to add a new user, such as the last 4
>>> digits of the bank account used for autopayment of monthly bills, the
>>> balance due on the bill from several months before, 2 factor
>>> authorization using the account's initial user's e-mail of record on
>>> the account, or other data that was required by Comcast when they
>>> originally established the account that would not likely be known by
>>> the imposter.  Of course, Comcast makes money if they allow imposters
>>> to run up charges whether validly ordered or not; so they have no
>>> incentive to tighten security.
>>
>> It takes more time for all that and simply asking for a PIN is easy and
>> fast.  Time is money to a business.
>>
>>
>
> And we all know Comcast is all about the almighty dollar. Customers be
> damned...

+2

"Adam H. Kerman" <ahk@chinet.com> wrote in
news:s7uavk$i7f$1@dont-email.me:

> Boris <Boris@invalid.invalid> wrote:
>>Adam H. Kerman <ahk@chinet.com> wrote:
>>>Boris <Boris@invalid.invalid> wrote:
>
>>>>Today I got an email from "online.communications@alerts.comcast.net".
>>>>Here is a cut and paste of the essence of the service order:
>
>>>Wow. That's quite a scam.
>
>>>Take your documentation of the call to Comcast and file a police
>>>report. There's simply no way this wasn't criminal activity.
>
>>I've dealt with the cops due to a burglary four years ago. The burglars
>>left forensic evidence ALL over the place and I had to TELL the cops to
>>take it with them. They did, but their report simply said Burglary at
>>such and such an address. I knew they wouldn't care, but I had to
>>report for insurance purposes.
>
> I'm sorry they refused to help you last time.
>
> With a police report number on the record, you might call Comcast back
> and let them know that you reported this AND you expect them to fix
> their billing system so your account doesn't get compromised again. Then
> ask for a large credit on your account. Comcast hates giving credits to
> subscribers and that might get the attention of a higher up.
>
> Speak to the Comcast liason at your village hall and have that person
> refer you to a Comcast subscriber service representative who has more
> authority.
>
> This is disturbing. My guess is that the owner of the pr0n service
> submitted a lot of names to Comcast claiming they ordered.
>
> A long time ago, when I was an AT&T subscriber, my account was both
> slammed and crammed thanks to federal rules allowing ANY billing entity
> to submit bills to AT&T's billing system (cramming) and AT&T itself
> putting unauthorized pre-paid long distance services on the bill
> (slamming). That took a long time to fix. One advantage of cable was
> that their subscriber billing systems weren't open to fraud like this
> but your experience demonstrates that that's no longer the case.

I posted this unauthorized user issue to the comcast (xfinity) forum, and
a Comcast employee has asked me to contact them personally. I want to
find out how this happened. Shylo, the rep on the phone who reversed the
unauthorized changes, did not know.

One thing I don't like when an issue on the forum goes private, others
don't get the benefit of the fix, if there is one.

I will report back.

What web browser are you using, and does it sync? Also some browsers,
Firefox for instance store passwords in plaintext and you can access
them through settings.

If you used that pc to log into Comcast with before and stored the
password/pin, that would explain how they found it.

Once they were logged in under your account, you are the only account
that can add users I would think.

azigni <azigni@yahoo.com> wrote in news:40XoI.43088$AU5.25003@fx29.iad:

> What web browser are you using, and does it sync? Also some browsers,
> Firefox for instance store passwords in plaintext and you can access
> them through settings.
>
> If you used that pc to log into Comcast with before and stored the
> password/pin, that would explain how they found it.
>
> Once they were logged in under your account, you are the only account
> that can add users I would think.
>

I understand what you are saying, but there is no pc at the rental home, and
I don't sync or use the 'cloud' anyway.

Boris <nospam@nospam.invalid> wrote in
news:XnsAD2E9B10530EEnospamnospaminvalid@144.76.35.252:

> "Adam H. Kerman" <ahk@chinet.com> wrote in
> news:s7uavk$i7f$1@dont-email.me:
>
>> Boris <Boris@invalid.invalid> wrote:
>>>Adam H. Kerman <ahk@chinet.com> wrote:
>>>>Boris <Boris@invalid.invalid> wrote:
>>
>>>>>Today I got an email from "online.communications@alerts.comcast.net".
>>>>>Here is a cut and paste of the essence of the service order:
>>
>>>>Wow. That's quite a scam.
>>
>>>>Take your documentation of the call to Comcast and file a police
>>>>report. There's simply no way this wasn't criminal activity.
>>
>>>I've dealt with the cops due to a burglary four years ago. The burglars
>>>left forensic evidence ALL over the place and I had to TELL the cops to
>>>take it with them. They did, but their report simply said Burglary at
>>>such and such an address. I knew they wouldn't care, but I had to
>>>report for insurance purposes.
>>
>> I'm sorry they refused to help you last time.
>>
>> With a police report number on the record, you might call Comcast back
>> and let them know that you reported this AND you expect them to fix
>> their billing system so your account doesn't get compromised again. Then
>> ask for a large credit on your account. Comcast hates giving credits to
>> subscribers and that might get the attention of a higher up.
>>
>> Speak to the Comcast liason at your village hall and have that person
>> refer you to a Comcast subscriber service representative who has more
>> authority.
>>
>> This is disturbing. My guess is that the owner of the pr0n service
>> submitted a lot of names to Comcast claiming they ordered.
>>
>> A long time ago, when I was an AT&T subscriber, my account was both
>> slammed and crammed thanks to federal rules allowing ANY billing entity
>> to submit bills to AT&T's billing system (cramming) and AT&T itself
>> putting unauthorized pre-paid long distance services on the bill
>> (slamming). That took a long time to fix. One advantage of cable was
>> that their subscriber billing systems weren't open to fraud like this
>> but your experience demonstrates that that's no longer the case.
>
> I posted this unauthorized user issue to the comcast (xfinity) forum, and
> a Comcast employee has asked me to contact them personally. I want to
> find out how this happened. Shylo, the rep on the phone who reversed the
> unauthorized changes, did not know.
>
> One thing I don't like when an issue on the forum goes private, others
> don't get the benefit of the fix, if there is one.
>
> I will report back.

There are two TVs in the home that have neither a Purchase Lock PIN, nor a
Parental Control Lock PIN.

The Comcast rep said that the change to the account was made in the home,
through the OnDemand option, on one of the two TVs that has no X1 Purchase
PIN. He mentioned nothing about a Parental Control Lock PIN.

What I've learned from www.xfinity.com/support is that a Purchase Lock PIN,
if created and enabled, prevents unauthorized
OnDemand purchases
subscription to new channels
PayPerView events purchases

See Getting Started, item 5, here:
https://www.xfinity.com/support/articles/x1-manage-tv-settings-online

Furthermore, the Parental Control Lock PIN, if created and enabled, *only*
prevents restricted content of whatever the user sets that needs a Lock PIN.

See:
https://www.xfinity.com/support/articles/x1-parental-controls-understanding-
parental-controls-and-pins

I say *only* because the instructions in the above link for the Parental
Control Lock PIN says, "Parental Controls let you restrict access to content
based on TV/Movie Ratings, Channels, Titles and Services." See the word
'Services" there? I don't know what 'Services' consist of. Are new
subscriptions/channel plans included in 'Services'?

I think the answer to that is, no, because if you look here, at the "Related
Articles" listed on the right side of this page, it appears that the Parental
Controls blocking options deal with things like movie and TV ratings,
channels, individual programs, and time of day, but not new subscription.

https://www.xfinity.com/support/articles/x1-parental-controls-turn-on-off

So, it looks like the renters just went into the OnDemand and ordered up
whatever they wanted, which included changes to the account's subscription
plan.

The fix, so this doesn't happen again, is to create a Purchase Lock on all
TVs in the home.

In article <XnsAD33B2593CF4Anospamnospaminvalid@144.76.35.252>, Boris
<nospam@nospam.invalid> wrote:

> So, it looks like the renters just went into the OnDemand and ordered up
> whatever they wanted, which included changes to the account's subscription
> plan.

When I signed up with the local cable company thirty years ago, they
immediately billed me for a porn thing entitled Tight Places. They
gave me a pretty hard time about it, even when I pointed out that we
hadn't even bought the house yet when the movie was ordered. They
finally, and grudgingly, credited me back for the movie. I told them
that they could rely on me never, ever ordering anything extra. That
day to this, I've kept my word.