This morning I checked my Gmail account for emails and stuff, and I noticed two mails from Walmart regarding two attempts to change the password of the Walmart account. But I've never created a Walmart account. My Gmail account uses an unique password (24 chars long and very secure) and 2 factor authentication. So the email account is not compromised, but to be sure I generated another password for it.
The two attempts of changing the Walmart password didn't succeed. So my next step was to reset the Walmart password my self with a one time password totally different from the others, to gain exclusive access to the account.
With further inspection the account doesn't hold any sensitive information, it's registered at the name of "Byedam Cali", no address was provided, nor any billing information, just my email address.
I contacted the customer care of Walmart asking to delete the account but so far no response. I'm in Europe, so in the US it's pretty late in the night.
So what to do next? And more importantly how was it possible? I mean the only way is that walmart doesn't send a confirmation mail when someone signs up. Any thoughts, advice?
Well difficult to say since it's a gmail account, so you know it's linked to youtube, google hangouts, and other services that I'm subscribed to. It's definetly possible that the email has leaked following a breach because I've been getting some spam lately.
Lo and behold, you don't get a confirmation email from walmart, so I can set up an account just by knowing the mail address. Nice walmart, thanks for caring about security, it doesn't even ask for the password twice. It just asks for the email, first and last name and the password... -.-
Check if your mail address has been leaked. The best way to do that is via the database at https://haveibeenpwned.com/ At least that way you'll know if it has been leaked or if someone made an honest mistake.
Then wait for Walmart's customer care to get back to you. That could take 48 hours. If they can't/won't delete it, just add walmart's address to your Gmail's blacklist.
just because you don't have a credit card doesn't mean that someone with enough information on you can't get a credit card in your name. ID theft at it's worst. I recommend checking your credit report ( I assume they have that in Europe as well) just to make sure something hasn't been opened in your name without your knowledge.