[2024] Account hacked!!!

Hey there,

I'm sorry to hear you've come back to things not quite as you left them. Unfortunately, if the hijackers have changed your in-game name, this isn't something we'll be able to assist you with - you can find all the info we can offer on character names here.

If you definitely had an authenticator previously, and the hijackers were able to remove your old authenticator and set up a new one, it means they had direct access to your registered e-mail address as this is the only way to remove an authenticator. So, I'd highly recommend you take the steps to secure all of your e-mail accounts as the first thing you do:

• Change the password to something brand new that you do not use anywhere else
• Enable two factor authentication.
• After the above two steps have been completed, log the e-mail address out of all instances. If you're not sure how to do this, you will need to find out through your provider.
• Finally, review the inbox rules currently in place on your registered email address - the hijacker might have set up 'rules' which will redirect your incoming emails to another email address, meaning you might not be receiving important security information about your account. Each email domain uses different systems, but for Gmail, you can follow the advice here or for Outlook you can follow the advice here.

I'd also recommend having a read through of our security advice to make sure you've covered all bases going forward to protect your account.

-Jagex Support

If you're happy to provide the character's current in-game display name, I can have a look and see if there's any more information I can provide about how the unauthorised access happened and how it can be prevented going forward, but I can't assist with recovering the character name or give any information about the users who may have accessed your account.

So it seems the account didn't have 2FA on it at the time of compromise - the last legit 2FA that was on the account was removed by the account's usual login. In that case, all the hijackers had to do was enter the login email and password to gain access to the account.

We can only guess how they got that info, but the two most likely ways are that the info was the same as info caught in any data breaches (you can use https://haveibeenpwned.com/ to find out if your information is included in any historic breaches) or that you were phished for it.

While I am genuinely sorry we can't help with the name, ultimately it's a player's own responsibility to keep their account secure, so I really would recommend reviewing the security guidance to ensure this doesn't happen again.