Customer loses $700 over THE ICONIC’s shocking security flaw
- Replies 9
In the digital age, online shopping has become a staple for many Australians, offering convenience, variety, and great deals.
However, the ease of clicking and buying comes with risks, as highlighted by one unfortunate incident involving THE ICONIC, Australia's largest online retailer.
A customer lost $700 due to a ‘critical lapse in account safety measures’ implemented by the online shopping platform.
They shared their plight on social media, saying, ‘Recently, my wife’s account was fraudulently accessed. Without any notification, warning, or confirmation, the email address associated with her account was changed.’
‘No steps were taken to verify this change, leaving her account completely compromised.’
‘The intruder went on to purchase a $700 watch using the credit card linked to the account,’ they added.
The customer also criticised THE ICONIC for having 'literally zero measures to guard, verify or even notify you of account changes.'
The alleged lack of basic security features is not only alarming but also goes against the expectations of customers who trust these platforms with their personal and financial information.
In response to these claims, news website news.com.au conducted its own investigation and confirmed that while THE ICONIC does send an email to confirm password resets, it does not notify the customer if the associated email address is changed, modified, or removed.
This meant that the customer did not receive any emails with receipts from the hacker’s $700 watch purchase.
The reason? The email address was altered.
Most companies send emails or text messages asking their customers to confirm if they are responsible for the ‘suspicious’ activity of accessing or changing their crucial information.
Typically, online services employ multi-factor authentication (MFA) to enhance security, requiring multiple proofs of identity before granting access to an account.
MFA is a critical layer of defence against unauthorised access, and its absence is a glaring omission in THE ICONIC’s security protocol.
The social media post resonated with many users, prompting discussions about the necessity of robust security measures like MFA.
‘The absence of these fundamental security features not only goes against customer expectations but also undermines the trust and reliability of a service that many use daily,’ the customer wrote.
‘Implementing these should be a basic standard, not an afterthought. It is inexcusable to not have these basic account security features in place.’
The customer also tried to get THE ICONIC’s attention, but they haven’t received a response yet.
‘Contacting them is laughably convoluted and slow,’ they said.
The customer’s post received several comments, and they called out the brand.
‘Multi-Factor [Authentication] is a must. I wouldn’t be trusting my credit card details with a site that didn’t support it,’ one person wrote.
‘Yeah, absolutely—unfortunately, THE ICONIC has zero account safeguards. We’ve taken steps to remove all CC (credit card) details from similar vendors and just rely on PayPal or ApplePay to prove an extra layer before a purchase can be made,’ another said.
A third added: ‘That sucks, I didn’t realise there was no security. They should add a minimum question [about] new device sign-ins and definitely notify of account changes.’
The post also prompted many to reconsider their accounts with THE ICONIC, with some deleting their payment information saved with the brand.
THE ICONIC’s spokesperson has acknowledged an increase in fraudulent activity and has urged customers to be vigilant with their account security.
‘We have recently seen an increase in fraudulent account login attempts on THE ICONIC, which our security and fraud teams continue to actively manage in conjunction with our security partners,’ the spokesperson said.
‘We are working with all customers to address these incidents, which are not a result of a data breach at THE ICONIC.’
‘The security of our customer data is of the utmost importance to us, and we continue to work with our third-party security partners to protect against all fraudulent activity.’
With the advancement of technology today, it’s easy to fall prey to sophisticated scams.
Case in point: A woman lost her entire savings to a text scam that appeared to be from her bank, HSBC. You can read the details about this scam here.
If you suspect that your account has been compromised, report it to your local law enforcement agency immediately.
You can also report it to Scamwatch here. You may also contact 000 in case of emergencies.
Have you ever encountered a similar situation? Share your experiences and tips in the comments below.
However, the ease of clicking and buying comes with risks, as highlighted by one unfortunate incident involving THE ICONIC, Australia's largest online retailer.
A customer lost $700 due to a ‘critical lapse in account safety measures’ implemented by the online shopping platform.
They shared their plight on social media, saying, ‘Recently, my wife’s account was fraudulently accessed. Without any notification, warning, or confirmation, the email address associated with her account was changed.’
A customer lost $700 due to THE ICONIC’s security lapse. Credit: THE ICONIC
‘No steps were taken to verify this change, leaving her account completely compromised.’
‘The intruder went on to purchase a $700 watch using the credit card linked to the account,’ they added.
The customer also criticised THE ICONIC for having 'literally zero measures to guard, verify or even notify you of account changes.'
The alleged lack of basic security features is not only alarming but also goes against the expectations of customers who trust these platforms with their personal and financial information.
In response to these claims, news website news.com.au conducted its own investigation and confirmed that while THE ICONIC does send an email to confirm password resets, it does not notify the customer if the associated email address is changed, modified, or removed.
This meant that the customer did not receive any emails with receipts from the hacker’s $700 watch purchase.
The reason? The email address was altered.
Most companies send emails or text messages asking their customers to confirm if they are responsible for the ‘suspicious’ activity of accessing or changing their crucial information.
Typically, online services employ multi-factor authentication (MFA) to enhance security, requiring multiple proofs of identity before granting access to an account.
MFA is a critical layer of defence against unauthorised access, and its absence is a glaring omission in THE ICONIC’s security protocol.
The social media post resonated with many users, prompting discussions about the necessity of robust security measures like MFA.
‘The absence of these fundamental security features not only goes against customer expectations but also undermines the trust and reliability of a service that many use daily,’ the customer wrote.
‘Implementing these should be a basic standard, not an afterthought. It is inexcusable to not have these basic account security features in place.’
The customer also tried to get THE ICONIC’s attention, but they haven’t received a response yet.
‘Contacting them is laughably convoluted and slow,’ they said.
The situation sparked awareness among several THE ICONIC shoppers. Credit: Freepik
The customer’s post received several comments, and they called out the brand.
‘Multi-Factor [Authentication] is a must. I wouldn’t be trusting my credit card details with a site that didn’t support it,’ one person wrote.
‘Yeah, absolutely—unfortunately, THE ICONIC has zero account safeguards. We’ve taken steps to remove all CC (credit card) details from similar vendors and just rely on PayPal or ApplePay to prove an extra layer before a purchase can be made,’ another said.
A third added: ‘That sucks, I didn’t realise there was no security. They should add a minimum question [about] new device sign-ins and definitely notify of account changes.’
The post also prompted many to reconsider their accounts with THE ICONIC, with some deleting their payment information saved with the brand.
THE ICONIC’s spokesperson has acknowledged an increase in fraudulent activity and has urged customers to be vigilant with their account security.
‘We have recently seen an increase in fraudulent account login attempts on THE ICONIC, which our security and fraud teams continue to actively manage in conjunction with our security partners,’ the spokesperson said.
‘We are working with all customers to address these incidents, which are not a result of a data breach at THE ICONIC.’
‘The security of our customer data is of the utmost importance to us, and we continue to work with our third-party security partners to protect against all fraudulent activity.’
With the advancement of technology today, it’s easy to fall prey to sophisticated scams.
Case in point: A woman lost her entire savings to a text scam that appeared to be from her bank, HSBC. You can read the details about this scam here.
If you suspect that your account has been compromised, report it to your local law enforcement agency immediately.
You can also report it to Scamwatch here. You may also contact 000 in case of emergencies.
.png){kind=icon}
