Hijacking inactive accounts in order to scam buyers is a common issue on forums. This post is from January of this year on the Xenforo support forum:
"We've had a few recent problems with old accounts being hacked for the purpose of "selling" goods (ie, scamming) in our member-to-member marketplace using these stolen identities. (The amounts are in the low thousands of dollars each, so it's serious.) Our forum has been around for 17 years (although only on XF for 3; before that on vBulletin), so I'm positive that we've got thousands of accounts with weak passwords that are going to be easy pickings for this approach in the future."
I have installed a software add-on that will security lock inactive accounts when a login is attempted. Any account that has not had a login within 180 days will prompt the member to reset their password.
The add-on description: This small addon will help you ward off the spammers using old accounts that have been breached. What this does is set the accounts security lock to "reset" which means the user will have to reset their password before they login. The way to reset the password is the standard Xenforo reset password function, they will get an email with the password reset.
I have set this to 180 days but can change it to another time limit.
"We've had a few recent problems with old accounts being hacked for the purpose of "selling" goods (ie, scamming) in our member-to-member marketplace using these stolen identities. (The amounts are in the low thousands of dollars each, so it's serious.) Our forum has been around for 17 years (although only on XF for 3; before that on vBulletin), so I'm positive that we've got thousands of accounts with weak passwords that are going to be easy pickings for this approach in the future."
I have installed a software add-on that will security lock inactive accounts when a login is attempted. Any account that has not had a login within 180 days will prompt the member to reset their password.
The add-on description: This small addon will help you ward off the spammers using old accounts that have been breached. What this does is set the accounts security lock to "reset" which means the user will have to reset their password before they login. The way to reset the password is the standard Xenforo reset password function, they will get an email with the password reset.
I have set this to 180 days but can change it to another time limit.
