* Lyft. Got a generic error when requesting a ride, which told me to contact support. I contacted support and they said my account was suspended due to violation of ToS with fradulent activity. I asked exactly what they think I did to violate ToS and they would not tell me. I've taken hundreds of 5-star rides, never comitted any fraud, I don't drive for Lyft or even know anyone who does. To this day I still don't know what I did "wrong."
* Instagram. Signed up for an account a couple years ago. Followed some celebrities and friends. A week later when I try to login, it errors saying my account has been suspended with no reason and recourse for recovery. I made another account. Banned again after a couple of days. Now, whenever I try to make a new account, the SMS verification never passes. It is like they have blacklisted my IP address.
* Letgo. It's like Craiglist. I moved within San Francisco a few years ago and signed up for an account to get rid of some furniture that I would not be taking with me. Within a few days I couldn't login and support told me my account was banned due to fradulent activity. All I did was create a listing for a couch with some pictures! I hadn't even gotten responses to the post.
* Google. I tried logging in to an old account associated with some domains in Webmaster Tools. That's all I use this account for and I haven't logged in in years. I enter in the right password and am greeted with "You’re trying to sign in on a device Google doesn’t recognize, and we don’t have enough information to verify that it’s you. For your protection, you can’t sign in here right now. Try again from a device or location where you’ve signed in before.". What am I supposed to do here? Last I used this account has at an old address (different IP) and on a computer that has since been retired (motherboard swapped out, OS reinstalled).
* Twitter. I created an account several years ago. After a week when I logged in it said my account was restricted and asked me to enter a phone number for SMS verification. I complied, and even after entering the correct code, it errored saying it cannot verify my identity. Haven't used Twitter since.
* Fidelity. This morning I tried to log in to my investment account and it says my account has been blocked "for security reasons" with no other information or explanation. It says I have to call Fidelity. Over the phone they asked me to supply a ton of documents over fax for identity verification and a record of all the devices I've ever used to sign into Fidelity. They won't even tell me why my account was blocked in the first place.
This is endlessly frustrating. There must be something unique about either me or my devices. I have a regular residental ISP in San Francisco, I'm not using Tor or VPNs, I use a vanilla Mac with Firefox. I use an adblocker (uBlock) but so does everyone else. I have a bog-standard Samsung phone running bog-standard unmodified Android.
Does HN know why my accounts keep getting banned? Especially for those who work on identity/trust and safety teams in Silicon Valley who have inside knowledge of how this works.
Fidelity might turn up something about identity theft, or credit reports, or red flags, or similar. If so, you can handle these. If not, then ask a private investigator for help; a good PI has research tools to find problems then help you fix them.
Make sure you are using MFA for any account which allows this. Don't re-use passwords, get a password manager like 1password or bit warden.
- check your credit report for any suspicious activity
- if you are tmobile client(or network that uses tmobile underneath), check to see if your SSN and DL was leaked last year
With something this persistent I'd also be open the possibility someone in your life is hacking you (room-mate, colleague, someone left alone with your tech) or maybe a very specific app you install on everything is compromised.
I'd get rid of most the hardware you own and start a new digital life from a coffee-shop nearby.
0: https://old.reddit.com/r/GooglePixel/comments/t2cuuu/help_pi...
These companies have a list of things they check for and if your score reaches a threshold you'll just be automatically locked out. In a lot of cases support will be totally useless and unable to help. I've tried to buy things before and been locked out, then just didn't bother, so it's their loss too.
Some offenders I've come across:
* Apple
* Amazon
* Ebay
* Netlify
* Patreon
* Discord
* Vercel (formerly ZEIT)
* SpareRoomMaybe also try checking your IP against various geolocation sites, just in case one is returning something wrong, or searching for it - see if it pops up on any sites as 'bad'
Now, moving on. You explicitly mention "SMS verification failed" for two separate providers. This to me smells as if your number has ended up on some fraud list (this could well be the reason behind Lyft too).
Perhaps you have been subject to SIM cloning ? Perhaps share your concerns with your phone provider ? Maybe go as far as changing your number (but perhaps not until you've fixed Fidelity if your Fidelity account is linked to your phone number).
Try creating a new email, and do not give anyone that email, keep it secret. Use this email to sign up for all new accounts. It will be a laborious process, but it's worth a try. If you want to be super paranoid rule out remote access to your devices or computers too -- get a new phone and do everything on there.
I'd unplug your router and then wipe your computer clean and change the password on your Wifi. Then plug in the router again and see if you get a new IP address. IF not, unplug it again and call your ISP and tell them the router is broken so they send you a new one, which hopefully will get a new IP. Oh and also you might need a new phone number as yours might be blacklisted now.
Then start making new accounts. In the meantime follow up with Fidelity because as a bank they have a legal duty to work with you and at least give you some clues as to what happened.
I use a randomly generated password with 30+ characters. If I can provide it then they should assume that it is me. This is what I get for using gmail.
* reinstall the OS on whatever desktop/laptop you use, don't install any browser plugins, get a pihole to help with ads.
* Buy some Yubi key or similar U2F token. Install authy or similar on your phone that supports TOTP and HOTP and allows for backups. Enable U2F or HOTP/TOTP on any site that supports it.
* Use bitwarden or something of similar capabilities (keepassx, bitwarden or similar functionality self hosted if you want). Keep notes on recovery codes, security questions, old passwords, data of account creation, which email to use for verification, etc. etc. etc. The more info the better when it comes to recovering the account. Always use a random answer to any security question, not anything easy to guess or discover about you.
* buy a new phone with a new phone number (keep the old if needed), ideally an IOS or Google Pixel, both of which have really good security and don't install random crapware from the cell provider or manufacturer. In particular avoid Samsung androids and the crapware they install from "partners" and cell providers.
* get a new online email address, use a strong password not shared with any other service. Enable 2FA, never use SMS for 2FA.
* Open a new credit card, set the notification threshold to $1.00 and have it email or SMS you any transactions. Use your new email account. Use said credit card online and offline.
* Create an account on an credit reporting/watching service like experian, watch for any fraudulent activity.
* for any new account use the new credit card, new email, turn on 2FA (not SMS), use a unique strong password, and keep notes in your password DB. The only connections to your previous existence should be your home address and name.
* Do not use your email address/account for posting apps to the Google or Apple stores, various automated scanning can trigger a violation that will impact your Apple or Google account associated with it.
My god, this happened to me last week as well!! Suddenly my Lyft account wouldn't let me book a ride, but provided no reason why in the app. When I contacted their support, I was escalated until a rep wrote back:
"After investigating the issue with our risk team, I'm unable to re-open your account. Legally, we cannot release any additional information except that we found your account to be violating our Terms of Service."
All follow-ups inquiries that I sent were ignored, so I ended up just deleting my Lyft account instead, because if they're going to be that Kafakesque, what's the point?
Still can't figure out what on my phone would have caused any issues, my phone setup is standard Android that is NOT rooted...
With good (if unfortunate) reason; the vast majority of old accounts are made by normal people as throwaways and likely have weak passwords that appear in existing password dumps. There is no other verifiable information attached to Google accounts with which attackers can be differentiated from the original user aside from any login cookies residing on a device that logged in before, and old accounts likely have access to other accounts as the recovery email address which would let attackers gain additional access to other systems by harvesting old Gmail accounts.
Your phone number may be associated with fraud in some way. Think about the only identifiers you give to these companies; IP (which changed without fixing the problem), name, phone number, email address. It's going to be one or more of those signals.
Is your Wi-Fi password nontrivial? Are you using WPA? Lock down your Wi-Fi and call your ISP to ask that they expire your dhcp lease or assign you a new static IP. (If that’s not possible switch isps. For example if you have ATT fiber you can switch to Sonic. The fiber is the same but the service is actually handled differently)
Less likely but still worth considering: Do do you reuse passwords? If you reuse passwords it’s possible someone is doing some fraud on your behalf. Check haveibeenpwned to see if a email address associated with your shared password has been leaked.
If you don’t already start using a password manager and use unique, nontrivial passwords for everything.
As for how to fix it, I'm not entirely sure. Since you are located in California, you might make CCPA requests to retrieve and then delete all of your data from as many companies as possible.
Does your email show up on haveibeenpwned?
The only thing I can think about, are bots doing credential stuffing and successfully inputting your password
When was the last time you updated your router firmware or changed your wifi password?
Is it possible your name or email address could be getting caught up in filters as a bad word or associated with something these businesses are against?
It seems very odd that this keeps happening over years, I'm really curious if some people from the companies mentioned will read this, and figure out what they have in common.
That means you either need a social media account with thousands of followers, or manage to write your story up in a way that will get you to the top of a major news source, such as HN.
What email provider are you using?
What telecom provider are you using for phone / internet?
Have you pickup up a new number in the last few years?
Is your internet shared with others?
Is your router a google wifi or similar updated router (or ISP provided)?
Any old computers on network?
When did you last run your credit?
Any changes in address overlap with this issue? In stone ages I used to have debt collectors literally coming to my door because of previous tenants. Also cops etc etc coming through. I only stayed there a few months, that address would have been trouble today I suspect.
Have you done any chargebacks in the last 2-3 years?
Something is almost certainly triggering a fraud detection system.
Check out datavisor for an example of how these things work.
https://www.datavisor.com/industry-solutions/marketplaces-ol...
False positive rates run 0.5% - 1% if folks are aggressive on these systems.
Fidelity might talk to you, but my guess is something backend is flagging, and no one on the front end will have a clue what its actually using to flag.
So some possibilities:
* your name is the same or very close to a target you don't know at all/have nothing to do with.
* you're working in an industry target by federal law enforcement. Big ones here would be sex work, cannabis, or political liberation
* Someone is repeatedly using your identity for something sinister. If this is a repeated pattern (which it sounds like), then it would make sense if that person is a close friend or family member. - Almost any time some is the victim of identity theft more than twice it turns out it's their partner or parent.
The emptier the account the quicker you are banned as well (work accounts used every now and then during work hours, like twitter, are banned quicker than a private account that you login to regularly and share more things on). Old accounts are usually unaffected for me. Probably removing cookies/localStorage/etc. on a schedule doesn't help either.
Every new account on a popular service where you can interact with others is like this. It's like everyone saw what google did to gmail, saw nobody cared about the collateral damage, and figured we can all fight spam without any human intervention. In the past we didn't have this problem because it was humans that looked at posts from new members. Innocent small Internet I guess.
I had an email *junk*@gmail and it was sometimes flagged.
Services that once let me use my Google Voice number, for example, locked me out until I could pass verification with a "real" mobile number over the years.
BTW that google problem happens to every old account before they required phone number backup.
Is your email or phone number used for anything besides personal activities? If your "work" is polluting your email, it may be getting caught on that.
You could try a new email that you never access from your phone, but if it is your phone number that is triggering it, that may not help.
The SMS never arriving is suspicious - are you on a major provider with a normal US phone number, or is it some other setup?
If you trip too many indicators, your account will be banned.
'Privacy conscious' people tend to get caught up in these anti-fraud systems.
Could it not be confirmation bias? I mean, if you have enough accounts you will have a list of accounts where you have trouble like this.
The only things I can think of are: are you using a low-cost VPN service, a Chinese or Russian free email account, or a free SMS number service?
(There are some good suggestions below re: FOSTA/SESTA and matching the experience of known sex workers, but I don't know if most US firms are consulting some master list here)
If you have a compromised device on your network, it might be being used as a proxy to attempt logins, or for other uses as a "residential proxy": https://datadome.co/bot-detection/how-proxy-providers-get-re...
It seems like your phone number is the main problem here. It’s tainted and is on some very bad lists. You should get a new number (or two) and transition over. It may also be helpful to get new phones and set them up afresh as much as possible.
These will let you run reports against your identity to see if any information has been compromised and used fraudulently.
The big three have to let you do one free credit report per year, which is a quick way to see if any new accounts were opened. Chex Systems has the same thing, but for bank accounts.
My guess would be malware infected devices or someone having your credentials (Do you use a new random password for each sevice?) or is making similar accounts and you are being targetted by measures taken against such actors.
For many of those services they would rather sacrifice a few via false positives, than spend more money to solve.
Have you had any other indications that your identity may have been stolen? Do you receive massive influxes of spam emails--thousands of messages at a time? Odd letters via snail mail?
Try creating a new email and register again in the services you are banned and wait and see what happens.
It's kinda frustrating, but on the other side it makes it more simple to avoid.
My only thought would be that your card is on the darkweb and these services are seeing it tested using their systems, blacklisting it and related accounts
Pure guess though, I can’t think of much more that would affect you across services like that
1. What is your nationality?
2. Are you on the OFAC list? Do you have a common name that might be on that list?
3. Are you on the SDN list? Do you have a common name that might be on that list?
4. Do you have an average+ credit score? (About 720+)
5. Any possibility you have a virus or other malware on your Mac?
If VoIP, someone might be spoofing your phone number.
Other than that, what I try to tell everyone to use 2FA authentication, and not just SMS text messages or TOTP's, but FIDO Security Keys to protect your digital identity. Never reuse passwords and use a password manager, yadda, yadda, yadda.
Some apps will attempt to detect this and then implement restrictions on accounts associated with jailbroken devices.
i had to call schwab to get them to allow me to login.
Otherwise... Dunno.