[2019] Account Security

Your account was hijacked back in January, seemingly via the creation email being compromised. The hijacker looks to have set their own email in that time, which is why you aren't getting the recovery emails.

https://support.runescape.com/hc/en-gb/articles/207217595-Hijacked-account

• Recovery request
• Enter your login email
• It'll say an email has been sent. You don't have access to the email, so click "I don't have access to that email address"
• Submit an Account Recovery form

For more context for the hijacking back in January. You had submitted multiple support tickets (which were immediately deleted) which I assume you were instructed to do by the hijacker. The hijacker had access to the account and read the messages, before deleting them. Within those messages was the password of the account, bank PIN, and tons more info.

It looks as though he was phished back in January. Believing he was talking to Jagex Support he provided the hijacker with a desired password.

It's just an assumption, I could be wrong. I looked at the context available (phishing ticket replies). We do not have plaintext passwords.

Jumping in here to provide a clear tech perspective.

Jagex do not store passwords in plaintext. Customer Support, developers and everyone else at Jagex do not have access to your passwords. Access to anything relating to passwords is controlled in line with GDPR, industry standards and common sense. Passwords are secured and protected using modern algorithms and all other functionality that is deemed appropriate by ourselves and the industry.

Seperately no capital letters etc. isn't great, but it is not related in any way nor representative of our security systems currently in place. Which is a common assumption I see made.

Our database of passwords / personal information have also never been leaked / compromised, to my knowledge. If it was, I believe we'd be legally obligated to reveal that information.