We've received around a dozen TikTok Shop account verification emails sent to current and former employees, and I also received one at a personal address. The messages appear legitimate and contain a six-character verification code. My guess is that someone is mass-registering accounts with lists of email addresses and attempting codes until one succeeds, although it could also be a phishing or account-abuse campaign. Has anyone else seen a sudden wave of these messages, and does anyone know what might be causing it?
4 Answers
I received one for a domain and mailbox that have barely been used, which makes ordinary targeted phishing seem less likely. I’d preserve a sample with full headers, notify affected users not to use the code, and contact the service through its official support or abuse channel.
I’d still treat the messages cautiously and avoid clicking anything. Check the headers and links for a consistent sending pattern, then filter or block the common indicators and report the activity to TikTok. If the emails are genuine signup confirmations, the addresses may simply be getting abused in bulk rather than specifically targeted.
A code-guessing or password-spraying-style attack is one possibility, especially if the service doesn’t properly rate-limit verification attempts. Another possibility is that the verification email is also triggered during login or recovery attempts, so receiving one alone doesn’t prove that an account was successfully created.
Several people have reported receiving these, including at old or rarely used addresses and in spam folders. It may be someone submitting large numbers of addresses during account creation and relying on a weak verification workflow, though the exact cause isn’t confirmed.
Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures