All my accounts stolen via some Jagex Account method

Hi,

I had a bunch of accounts that got stolen from me because they were never used on Steam or Jagex account. My friend of a few years knew my sign ins because he would use them sometimes, and today I woke up and I was blocked and all of my accounts were gone. He never knew the email sign in for any of the registered email accounts (he did not know username or password) and no code was ever sent to any of the registered email accounts, only confirmation emails saying that the accounts were added to a Jagex account.

• There was a total of 5 accounts that this happened to
  
  
• All 5 accounts had unique registered emails and passwords
  
  
• I replicated the process on one of my accounts, and I received a code to confirm the transfer, so I am unsure on the method that was used to make it so that a code or confirmation was not required.
  
  
• I have never downloaded any files/have no keyloggers on my computer, the main account(s) that I use were not compromised
  

I'm well aware that this is my own fault for giving out the sign ins to begin with, but this seems like a massive oversight. Is anyone else aware of this issue, is there more I can read about somewhere?

Has anyone else experienced similar issues? Is there any way to recover these accounts?

 

This is likely a case of a remote administration tool. Scan your PC and reset it if you cant find anything, then to proceed change all your passwords to all emails. Set-up 2FA on everything. I have heard only of 2 case in the last few months of jagex accepting false recovery appeals. So I doubt they could have pulled this off without a keylogger or likely a RAT on your pc, they could have waited till you were sleeping and did it right from your own PC deleting the emails to hide the tracks.

 

To my knowledge and based on experience, he would have needed access to the registered email of the accounts to make them Jagex Accounts.

So your friend never knew the email, but knew the login information for the accounts? Were the logins character names and not emails?

 

Not possible, my PC was powered off and my actual main accounts that I actually play were left untouched. No keylogger/etc on my PC. There is some method to steal accounts by converting them to Jagex Account, without verifying via registered email, maybe a bug or a method but this is something that needs to have attention directed to it

 

He never knew the email usernames or passwords, because the creation email and the registered email were not the same and I made sure to secure my emails. When I replicated the process, I received a code to confirm it. So no idea how he didn't need to get a code

 

This is a very serious situation indeed I think I'll start by suggesting anyone reading this post, take extra precautions till we know what we're dealing with. In the meantime, I'll keep an ear out of for any other cases like this and report back.

 

It is possible that he deleted the email(s) asking for the verification code to make them Jagex Accounts. I would say think hard as to how he would have known or have access to the emails associated with those accounts. There might have been a miscalculation on your end regarding that.

 

Nah, I can assure you it is impossible. However, apparently you can add accounts to your existing jagex account without email access is what I was told by some other folks.

 

Would reaching out to Jagex be an option? If your PC is clean and its not a RAT as the other guy suggested, then there is a serious issue with their Jagex Account system.