Your money is not secure on Party Poker

[beanie]

In late December I had a family member want me to teach her to play poker, she had seen an ad for Party Poker and I helped her open an account. We opened the account at my house and used my beaniepoker@hotmail.com, I told her she could change it once she got to her computer (which she regrettably did not do), otherwise we would have to wait to play. This is where things fall apart. One of the people working for me at the time left on unpleasant terms. Apparently he accessed my e-mail and told www.partypoker.com that my family member died and he needed to change the account to a name that:

1. Did not have the same last name as my family member
2. Did not have the same address as my family member
3. In fact, there was literally no reason to believe that this person even knew my family member (which he didn’t)
4. They required no information whatsoever to give this person full access to my family members account.

I only noticed that the name had changed when I was transferring a friend money and I looked and saw that the account name had the name of the another person attached to it, the father of the person who left my employ disgruntled.

The long and short of this is, Party Poker gave someone access to $2000 of my family members money with nothing more than an e-mail. No supporting information at all. Now to get access to the account my family member has to send in this information:

1. Drivers License-seems reasonable, they likely want to prove she is not dead.
2. Preffered application-this is where things get interesting they want to be able to pull her credit so they can prove that she is not dead. Even though they did not ask this of the thief. They did ask the thief for his drivers license which he apparently obliged feeling that for $2000 he would gladly send in his father’s drivers license.
3. Police Report-this seems unreasonable to me, my family member feels like reporting that she was playing online poker might get her in trouble. Which I agree.

The person I spoke to at Party Poker was named Aravinda. This should trouble you if you have a Party Poker account, apparently all a thief needs to say is that you are dead and they can send in a drivers license and get all of the money in your account. Rather than doing the right thing once they saw a fraud was committed, they even told me that the person transferred the money out of the account to another account, they are putting my family member up to a level of scrutiny that they did not put the thief to. I have given her $2000 for her lost money. But if you have a Party Poker account your money is not secure.

[lorinda]

Apparently he accessed my e-mail

So actually you meant to say that your email provider is not safe, not your money on party poker?

Lori

[fyodor]

[ QUOTE ]
Apparently he accessed my e-mail

So actually you meant to say that your email provider is not safe, not your money on party poker?

Lori

[/ QUOTE ]

This should have been the end of this thread.

[sammy_g]

[ QUOTE ]
Apparently he accessed my e-mail

So actually you meant to say that your email provider is not safe, not your money on party poker?

[/ QUOTE ]
Email is really easy to spoof, particularly if the recipient only looks at the From: header.

[JPNet]

Exactly. If a site, any site, will look at the From portion of an email, match it to the email address they have on file, and then proceed to make requested changes, we are in big trouble. All I need to know, presumably, is that you have an account at the site, and the email address you used to set the account up. I can send an email from any email address you would like, no password, or email access of any kind required. I don't even need to have an email address of my own.

I find it hard to believe that any commercial site would act based on the from address alone, because it is so easy.

[beanie]

that is really the only point I was making from the beginning. I don't mind answering questions because people make a lot of baseless allegations. This person found a loophole (fake death) and exploited it. I am unhappy that Party Poker has taken the stance they have and I am using my only outlet. Fact is, there is no recourse for her against Party Poker. We trust these sites with a lot of money, when they act irresponsibly, someone should let them no its not OK to change all of the information on an account with just an e-mail. If you don't believe my account of the facts, I hear ya, it seems unbelievable that they would do this with just that amount of info.

[Tachyon]

Sure, but the actually reply that the Online Site sends will go to the actual account holder, who would obviously reply (you would hope) with a "WTF are you doing!"

John

[Freudian]

Something about this doesn't smell right. Smells like some gnome account where something went wrong.

[beanie]

Not the case at all. The e-mail is a hotmail account, so it is concievable that while making a sandwich he sent the e-mail. In fact, party poker fully admits they dropped the ball on this one. I mean come on all you need is an e-mail that says someone died and they will change the name, address and e-mail. That has to be a thief's dream. I can see maybe requiring a driver's license or some mail or something to prove identity but why does she have to report to the police that she plays online poker. That seems reasonable to you?

[Freudian]

[ QUOTE ]
Not the case at all. The e-mail is a hotmail account, so it is concievable that while making a sandwich he sent the e-mail. In fact, party poker fully admits they dropped the ball on this one. I mean come on all you need is an e-mail that says someone died and they will change the name, address and e-mail. That has to be a thief's dream. I can see maybe requiring a driver's license or some mail or something to prove identity but why does she have to report to the police that she plays online poker. That seems reasonable to you?

[/ QUOTE ]

It seems reasonable that the police knows where the theft took place if a theft is being reported to them.

Still sounds fishy to me. Was this a second account with rakeback?