# Pandora Scam? **URL:** \ **Category:** Factual Questions\ **Created:** [July 11, 2016, 2:18pm UTC](https://boards.straightdope.com/t/pandora-scam/759652 "2016-07-11T14:18:50Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![Shodan](https://avatars.discourse-cdn.com/v4/letter/s/9f8e36/32.png) [@Shodan](https://boards.straightdope.com/u/Shodan)\ **Post date:** [July 11, 2016, 2:18pm UTC](https://boards.straightdope.com/t/pandora-scam/759652/1 "2016-07-11T14:18:50Z")
Good morning (where I am). I got an email to my Gmail saying that Pandora was hacked, and that my user account was listed under those who had been accessed. The email had a link where I could reset my password. First, I didn’t realize that I had a password on my Pandora account, which I seldom use and is only on my phone. Second, I have a nasty and suspicious mind, and assume right off the bat that this is a scam, and someone wants to hack into my phone and do unpleasant things. Has anyone else received this email? Is it real? What are the consequences, if it is real and I don’t reset my password? I did a quick Google but didn’t find anything conclusive, apart from the standard advice not to click on links in unsolicited emails. Don’t need answer fast, but any information from the Dope would be welcomed. Regards, Shodan ---
**Author:** ![AlsoNamedBort](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/alsonamedbort/32/3213_2.png) [@AlsoNamedBort](https://boards.straightdope.com/u/AlsoNamedBort)\ **Post date:** [July 11, 2016, 2:26pm UTC](https://boards.straightdope.com/t/pandora-scam/759652/2 "2016-07-11T14:26:21Z")
Never click an unsolicited link to “reset your password.” It’s most likely a phishing scam. If you are worried, go to [pandora.com](http://pandora.com) and reset your password from there. ---
**Author:** ![Jophiel](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/jophiel/32/66_2.png) [@Jophiel](https://boards.straightdope.com/u/Jophiel)\ **Post date:** [July 11, 2016, 2:40pm UTC](https://boards.straightdope.com/t/pandora-scam/759652/3 "2016-07-11T14:40:03Z")
You DO have a password on your Pandora account though. Even free accounts are password protected. I don’t know what good a stolen Pandora account does anyone, unless they’re just hoping to connect that email/password with other accounts. I don’t think they save credit card info in any accessible way (last four digits maybe). Still, **enalzi** is right and you should go there directly to change it. ---
**Author:** ![kayaker](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/kayaker/32/441_2.png) [@kayaker](https://boards.straightdope.com/u/kayaker)\ **Post date:** [July 11, 2016, 2:58pm UTC](https://boards.straightdope.com/t/pandora-scam/759652/4 "2016-07-11T14:58:59Z")
I got the email as well. Seems to be legit. ---
**Author:** ![Thudlow\_Boink](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/thudlow_boink/32/320_2.png) [@Thudlow\_Boink](https://boards.straightdope.com/u/Thudlow_Boink)\ **Post date:** [July 11, 2016, 3:09pm UTC](https://boards.straightdope.com/t/pandora-scam/759652/5 "2016-07-11T15:09:17Z")
> [@AlsoNamedBort](#): > > Never click an unsolicited link to “reset your password.” It’s most likely a phishing scam. If you are worried, go to [pandora.com](http://pandora.com) and reset your password from there. Yeah, you don’t have to have a “nasty and suspicious mind” to think that sounds like phishing. Even if it is legit, emailing users a link to click on to reset their passwords is a dumb way to do it. But I did find articles [here](http://www.businessinsider.com/pandora-usernames-compromised-2016-7) and [here](http://thenextweb.com/apps/2016/07/07/psa-pandora-says-accounts-risk-hacked-change-password-now/), at what look like reputable sites (though I’m not specifically familiar with them), showing the email that may be the one you got, and explaining that Pandora itself wasn’t hacked, but some people’s Pandora usernames and passwords seem to have been released from another source. (So, if the email you got actually did say Pandora itself was hacked, that’s not the one these articles are talking about.) ---
**Author:** ![Blaster\_Master](https://avatars.discourse-cdn.com/v4/letter/b/cab0a1/32.png) [@Blaster\_Master](https://boards.straightdope.com/u/Blaster_Master)\ **Post date:** [July 11, 2016, 3:36pm UTC](https://boards.straightdope.com/t/pandora-scam/759652/6 "2016-07-11T15:36:21Z")
Safe bet, whenever you receive an email like this, legit or not, go directly to the site and change the password. Either it actually WAS cracked, and your password needs to be changed, or it’s phishing, and going directly there bypasses their bad link and changing the password doesn’t hurt. And as for how much a Pandora account is worth, on it’s own, not much. But I doubt that’s what they’re really after. A LOT of people will use the same or similar passwords for multiple accounts, so if they can attach an email to a password, there’s probably a significant number of email accounts they could crack just from trying the pandora password at that email account. Even if it’s not the same as the email, they might try other important accounts with a known working username and password, like facebook, bank accounts, or other similar things. Yeah, personally, my pandora account doesn’t have a particularly strong password, but I don’t particularly care if it’s attacked, since I just lose a couple stations I can recreate with minimal fuss. The important thing is that it’s different from all of my critical accounts, which are all complex passwords and different from each other. ---
**Author:** ![Shodan](https://avatars.discourse-cdn.com/v4/letter/s/9f8e36/32.png) [@Shodan](https://boards.straightdope.com/u/Shodan)\ **Post date:** [July 11, 2016, 5:44pm UTC](https://boards.straightdope.com/t/pandora-scam/759652/7 "2016-07-11T17:44:10Z")
Thanks for your responses. I don’t know what the password on my Pandora account is - Pandora came with my phone, and I don’t recall logging in, ever. (Maybe I just don’t remember.) Regards, Shodan ---
**Author:** ![Boyo\_Jim](https://avatars.discourse-cdn.com/v4/letter/b/87869e/32.png) [@Boyo\_Jim](https://boards.straightdope.com/u/Boyo_Jim)\ **Post date:** [July 11, 2016, 6:17pm UTC](https://boards.straightdope.com/t/pandora-scam/759652/8 "2016-07-11T18:17:56Z")
> [@Shodan](#): > > Thanks for your responses. I don’t know what the password on my Pandora account is - Pandora came with my phone, and I don’t recall logging in, ever. (Maybe I just don’t remember.) > > Regards, > Shodan If you’ve never used the app or used Pandora on your PC, you never established an account. Which makes this some kind of phishing expedition. If you’re unsure whether you even have an account, you can go to Pandora and try signing in and select “Forget my password”. They’ll prompt you for an email address to send a reset code to, and if your email address isn’t in their system, it’s very unlikely you have an account at all. ---
**Author:** ![Shodan](https://avatars.discourse-cdn.com/v4/letter/s/9f8e36/32.png) [@Shodan](https://boards.straightdope.com/u/Shodan)\ **Post date:** [July 11, 2016, 7:41pm UTC](https://boards.straightdope.com/t/pandora-scam/759652/9 "2016-07-11T19:41:35Z")
I haven’t used it on my PC, but I have on my phone. I have reset my Google password recently. I haven’t ever done that thing where I give Google or Windows my phone number, because I don’t trust them not to abuse it. But if my Pandora password is the same as my Google password, it has been reset already. Regards, Shodan ---
**Author:** ![CalMeacham](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/calmeacham/32/35_2.png) [@CalMeacham](https://boards.straightdope.com/u/CalMeacham)\ **Post date:** [July 11, 2016, 8:09pm UTC](https://boards.straightdope.com/t/pandora-scam/759652/10 "2016-07-11T20:09:47Z")
I got the email as well, which surprised me, because I don’t HAVE a Pandora account, and never did. I was sure it was a phishing scheme. I reported it to Pandora, using the contact form on their website. I just got an e-mail back from them. The original e-mail is apparently legit, and there was some sort of mixup responsible for my getting the e-mail. ---
**Author:** ![Shodan](https://avatars.discourse-cdn.com/v4/letter/s/9f8e36/32.png) [@Shodan](https://boards.straightdope.com/u/Shodan)\ **Post date:** [July 11, 2016, 8:37pm UTC](https://boards.straightdope.com/t/pandora-scam/759652/11 "2016-07-11T20:37:04Z")
How did Pandora have your (or my) email address without an account? Regards, Shodan ---
**Author:** ![Jophiel](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/jophiel/32/66_2.png) [@Jophiel](https://boards.straightdope.com/u/Jophiel)\ **Post date:** [July 12, 2016, 1:04am UTC](https://boards.straightdope.com/t/pandora-scam/759652/12 "2016-07-12T01:04:07Z")
> [@Shodan](#): > > How did Pandora have your (or my) email address without an account? They probably had the list of emails/passwords that were hacked from other sites and Pandora was comparing to their own records. Although **CalMeacham** didn’t have an account with Pandora, they mistakenly thought he did and contacted him via the email from the “hacked list”. ---
**Author:** ![Isilder](https://avatars.discourse-cdn.com/v4/letter/i/cc9497/32.png) [@Isilder](https://boards.straightdope.com/u/Isilder)\ **Post date:** [July 13, 2016, 3:50am UTC](https://boards.straightdope.com/t/pandora-scam/759652/13 "2016-07-13T03:50:42Z")
Always ensure that the email links to the real website for [pandora.com](http://pandora.com), always ensure it goes to [pandora.com](http://pandora.com) pandora.XYZ , [pandora-admin.com](http://pandora-admin.com) and other variations may well be a hack… a phishing attempt. When you do click on it, ensure the url’s STAY at the original proper website… phishing attempts are usually against financial sites though… banks and paypal… be more careful with your financial accounts !