Account issues

[Impaler99]

I recently had my account compromised and the person used it to macro and my account was banned.  I sent in a ticket a few days ago, and recieved a responce today stating-

Hi there,

This is an automated email from Jagex Games Studio.
 
Our systems have detected a period of unusual activity on your account, and we have removed any offences which occurred during this time as we believe the offence was not committed by the owner of the account.
 
You are now free to access the account and continue playing.

 

However, my account is still banned and I got that email 5 hours ago.  Does it take some time to go through, or should I seek additional help from Jagex?

[Arceus]

Click 'account' near the top right of the homepage and then log in and see what it says under 'Account Status.' It should indicated that those offences are struck off; if not, I guess it may need more time to go through or you might want to write them back letting them know that the offenses are still there and haven't been removed.

[Impaler99]

Thank you again for your help!  If it weren't for you I wouldn't have even found where to message them.  Ill give it a few hours, and if it is still saying banned when I get home from work I will send them another message.

[Arceus]

Does it give you an opportunity to respond there then? Usually it just shows a list of offences and messages from JMods, but if you're lucky you may have an option to respond to it :).

[Impaler99]

It was a non appealable one, so it didn't give me any options.  Another friend said I should try logging into the game, as it may not be updated on the website yet.  At work though, so I'll have to wait to get home to try that.

[Dropbox]

Jagex uses a new appeal system, macoring can't be applied anymore.

[Arceus]

Jagex uses a new appeal system, macoring can't be applied anymore.

They still make exceptions if you can prove it wasn't you on the account in some cases though, right? Otherwise I'm at a loss as to why Imapler received that email in the first place.

[Impaler99]

yeah, they emailed me saying it was lifted and I should be able to play. Not sure why they would do that if they didnt mean it, they verified it was not me who committed the offences. the next 40mins til I get home to try to log into game is going to feel like forever. while I will be happy if I cant login, still means I cant add an authenticator yet, which was the first thing I tried doing.

[Impaler99]

Sadly I cannot log into game either.  Sent in another ticket, really confused right now.  Kind of hoping something is just bogged down and I'll wake up tomorrow and be able to play on my day off.

 

I hate myself for having the J A G and not knowing they had an actual authenticator now.  Only recently came back...and I only just realized that J A G is something they don't even 'offer' anymore unless you previously used it.  :S

[Arceus]

That is really weird. Is your email secured with two-step verification? If not you should definitely set that up if/when you get your account back. I wouldn't kick yourself too much for still having JAG though - it is secure in most cases unless they somehow spoof your IP or something.

[Impaler99]

My email is, but my account was not.  That was the first thing I tried to do when I got the message, it's how I knew I was still banned. :(

 

I really don't understand though how the J A G protected me days before it happened, but then somebody managed to get on my account.  Had a person who I know from the FC I am always in tell me that my account was indeed logged in on OSRS and playing.  Come to think of it, when I moved (From alabama to south carolina) and just recently started playing again on the account, in a new home with a new ip on a brand new computer, I simply logged in and nothing happened.

 

Possibly the email from the guardian was a phishing email?  I never clicked on anything in the email though, so I don't know...I'm really at a loss.

 

Jagex Player Support <[email protected]>

 

Thats legit right?  I'm SO confused at everything now.

[Arceus]

Not to try to scare you but that's generally not enough information - you would need to get the full header from the email and look it up to make sure. But like you said, since you were expecting an email from a ticket, and they didn't ask you to click on anything, you're probably fine.

[Impaler99]

I know 100% the email I got today was from them, this is the one from days before alerting me that somebody had tried to access my account and gave me an IP and such.  

 

The link in the JAG email from days before DOES link to the actual RS website in the link I never clicked, I think I'm just looking too much into this trying to figure out how it happened.

 

Edit* Upon further inspection, it matches the original email I got when I set up the JAG.  

I guess what I really want to know why the JAG protected me and then three days later didn't.  :/  I've scanned with malwarebytes, tdds, superanti, hitmanpro, combofix...and a few others JUST to be sure, and nothing at all was found but tracking cookies (of course lol)

[Arceus]

I guess the other possibility is that they managed to farm your JAG question answers and somehow convince Jagex that they were the owner of your account? That's the only thing I can think of.

[Impaler99]

I did login to account management at work, as well as read that email at work (the legit JAG one)  Another slight possibility is that computer is riddled with something nasty.  Even without clicking that link it is entirely possibly that the culprit could have gotten that link himself just from me opening the email on that computer.

 

I should stop trying to make sense of it and just be patient.  Knowing won't change anything, regardless the solution is to use all available security options.  And not be stupid enough to log in at work.

[essiw]

My email is, but my account was not.  That was the first thing I tried to do when I got the message, it's how I knew I was still banned. :(

 

I really don't understand though how the J A G protected me days before it happened, but then somebody managed to get on my account.  Had a person who I know from the FC I am always in tell me that my account was indeed logged in on OSRS and playing.  Come to think of it, when I moved (From alabama to south carolina) and just recently started playing again on the account, in a new home with a new ip on a brand new computer, I simply logged in and nothing happened.

 

Possibly the email from the guardian was a phishing email?  I never clicked on anything in the email though, so I don't know...I'm really at a loss.

 

Jagex Player Support <[email protected]>

 

Thats legit right?  I'm SO confused at everything now.

That e-mail seems like a scam (why would they use @a.jagex.com instead of @jagex.com)

[Arceus]

 

My email is, but my account was not.  That was the first thing I tried to do when I got the message, it's how I knew I was still banned. :(

 

I really don't understand though how the J A G protected me days before it happened, but then somebody managed to get on my account.  Had a person who I know from the FC I am always in tell me that my account was indeed logged in on OSRS and playing.  Come to think of it, when I moved (From alabama to south carolina) and just recently started playing again on the account, in a new home with a new ip on a brand new computer, I simply logged in and nothing happened.

 

Possibly the email from the guardian was a phishing email?  I never clicked on anything in the email though, so I don't know...I'm really at a loss.

 

Jagex Player Support <[email protected]>

 

Thats legit right?  I'm SO confused at everything now.

That e-mail seems like a scam (why would they use @a.jagex.com instead of @jagex.com)

 

Assuming it's not spoofed, any subdomain of Jagex.com is still legit. You just need to check the links in there carefully before clicking to make sure they're taking you to a page on runescape.com and not some other scam site (if there are any links). I'm not sure why they use a subdomain - probably they have different servers to send out account help emails, replies to law enforcement queries, etc. That would be my guess, but again as long as jagex.com is the top level domain it's fine. If it were jagex.[somethingelse].com, that would be a red flag ;).

[Impaler99]

EDIT After FURTHER inspection, the JAG email is 100% legit.

 

 

"Received from: ******.bluehornet.com

The email addresses that we are currently using are:

• [email protected]
• [email protected]"'

From RS website.  Everything checks out if I show original.

[Arceus]

It's possible they got a drive-by in with an invisible image hotlinked in an email I guess, but most emails are supposed to block images unless the source is authenticated. I hope Jagex will indeed make good on their word to unban you though.

[Impaler99]

I hope so.  If not I'm not sure that I could start over again (was just getting to the point where I didn't feel like I was playing catch-up to my old account)

 

Contemplating ironman, but being honest...not entirely sure I have it in me.  Im the guy that buys all quest items at 1000% cost because I want to be lazy and do things fast. 

Or maybe, it will make things feel more epic and I will enjoy having to go out and earn each piece of anything.

But it would not be cool to not be able to DG with friends. :(

 

I tweeted them to confirm that the email I recieved yesterday is legit, now more waiting!  :D  Because I've inspected every link, header, everything...if it's a phishing email the person is REALLY GOOD.

 

Want to know the sad thing about me getting my account compromised and not having all security measures?  I'm a computer tech, and I do this for a living.  :/  I'm like a doctor that smokes.  

[Arceus]

I wouldn't feel bad about yourself. Anyone can make a mistake and it happens to the best of us - and it's not even clear that you did something wrong in any case. Weird things happen. I do hope Jagex comes to their senses on this though.

[Impaler99]

20-Apr-2015 Macroing Major (ban) Quashed

The wait is OVER.  Still can't put an authenticator on though.  Site has to catch up, currently in game and NOT logging out until I can put an authenticator on! 

 

THANK YOU again for all your help, without you I never would have even sent an appeal!  I really REALLY owe you.

 

Mod Bear is VERY nice.  

"I have had a look at your account and it looks like the system was a bit delayed in removing the ban. I have now gone in and forced this through, so you now should be good to go!

It's great to have you back my friend :)"

 

That message made me feel appreciated as a customer.

 

Not to mention, that ticket was responded to within 12 hours of sending it!

 

EDIT*  Authenticator added!  

[Arceus]

Great to hear man, glad you got that resolved and your account secured. Have fun! :)

[Miss Lioness]

Great to hear! Fantastic news and we are glad we could help you with it! I am intrigued to what has happened to your account.

[Impaler99]

Either I got lucky and they didn't log in to rs3, or my account was reset to when I last logged out.  Either way I'm very happy, and secure now!  

 

I still would love to know how I was compromised, as it was not my personal computer.  Will be scanning my work computer monday to find out if that was the culprit.