Locked user has requested we change their obsolete email address. Possible security risk?

Mr Lucky

Mr Lucky

Well-known member
Licensed customer
We have received a request via contact form from a user whose account is set to locked. It seems the email address registered is no longer valid and they are requesting the password reset be sent to a new email address. Although this could be totally legit I am concerned that this could also be someone attempting to take over an old account.

What is the best course of action in this case?

Perhaps grant the request to change email but set the account to awaiting approval?

Or Remove the security lock and set to awaiting approval so they can change the email themselves?

Obviously to login and get the password reset they must have their password so is this therefore nothing to be concerned about?
 
It is coincidentally it’s locked, but maybe they triggered the lock?

Ask a few “security” questions the member ought to know.
 
CedricV said:
It is coincidentally it’s locked, but maybe they triggered the lock?
Click to expand...
No I have locked all accounts noit logged in since x years. This is a normal security measure I was advised

S

XF 2.2 Thread 'Old users are becoming SPAM everyday !'

Hello

Recently I upgraded our forum from 2.2.8 to latest version and I noticed that many old users are becoming SPAM everyday (5 to 10 old memberships are stolen everyday and posting spam threads). I can't see any relation between the upgrade and the issue, however, this is what happened. Is it a coincidence? Is this a new method of SPAM attacking to steal the users accounts instead of new registration? I mean I am moderating this forum since 2006, moved to Xenforo since 2015 and I didn't face something similar.

Currently I am trying to control the SPAM posts by banning many valuable...
 
I would unlock the account and let them know if they can log in (they know the password) then they can change the email themselves. I definitely wouldn't change the email address just because I received an email asking to do so unless I could verify the account owner somehow.
 
You must log in or register to reply here.
Back
Top Bottom