Email account compromised. Can't removed associated recovery mails which aren't mine

[Mobious]

Hi everyone,

I have an urgent issue where my email account was hacked a while ago and I have changed the password etc, however I have discovered that there a number of recovery emails assigned to the account which aren't mine. How do I remove all recovery email addresses and so I can put my own in to resecure the site.

I looked at Yahoo email and there isn't an option there to remove the back up addresses.

[caesarome]

Go to Settings > More Settings > Filters and remove anything that you did not setup.

Then go to Settings > More Settings > Mailboxes > Your email address > Reply-to address

And again remove anything here that you did not setup.

Then logout and change your password:

https://skyid.sky.com/resetpassword/

Also what shows here regarding the email addresses:

https://www.sky.com/myaccount/my-details

[Mobious]

Thank you for your reply.

From the sky side, there doesn't appear to be any associated emails, what I am specifically looking for is the alternative verification email.

So I log into Yahoo and for example I forget the password. It will say there are 3 email addresses which we can send a verification to. None of those are my email accounts.

I have two step verification turned on and I have changed my password, but there doesn't appear to be any option on Sky or Yahoo, to remove those verification email addresses.

Thank you for taking the time to respond.

[caesarome]

---

@Mobious wrote:

I have two step verification turned on and I have changed my password, but there doesn't appear to be any option on Sky or Yahoo, to remove those verification email addresses.

To turn off 2FA sign in with the recovery code so at the login select "can't sign in with the code" link. You'll then be asked for the recovery code.

When you signed up to 2FA you were given a recovery code so if you didn't make a note of it then check the email you were also sent.

[jayach]

---

@Mobious wrote:

So I log into Yahoo and for example I forget the password. It will say there are 3 email addresses which we can send a verification to. None of those are my email accounts.

---

I have seen that as well, and I wondered where it gets the addresses from, as they don't seem to be in the account itself.

I suspect it gets them from the browser via the cache/cookies as by using a different browser I didn't get the same email addresses.

Try using a different browser, and see if it is the same for you.

I don't think it is a security risk.