In an answer on Meta Stack Overflow, Brad Larson ♦ mentions,

In the vast majority of cases where the 100-point penalty is applied and a moderator notices, the account is also destroyed....

The few outlier cases tend to be when you have an otherwise good account that all of a sudden posts something bizarre. Sometimes it's a compromised account, sometimes people leave themselves logged in at a shared computer, etc.

In the cases where a contributing user does get hacked, and the hacker starts making red-flaggable posts (e.g. Spam, nonsense, or personal attacks), is there a procedure for separating out the penalties due to the hacker and negligence penalties applicable to the original account owner once the owner regains control? That is, if someone hacks my account and spams with it, am I "stuck" with the applicable black marks against my account (-100 rep penalty for each post, suspensions, question bans, etc.), or is it normal or expected for such posts to be disassociated or at least have applicable penalties reversed? For example,

I have disassociated the three Spam posts that the hacker made with your account, which will refund the 300 rep you lost as a result and lift your question ban. Unfortunately, it seems that you are not entirely innocent because you left your account logged in at a public library where the spammer found and took advantage of it, so I am Suspending you for a week so you can spend some time thinking about best practices in information security. Come back in a week to continue contributing.

At first I thought that it would be normal, natural, and just for all penalties to be reversed against the hacking victim upon submission of proof of victimhood, but then I remembered that I have dealt with some organizations other than Stack Exchange that have had Terms of Service clauses that more or less said "You agree to keep your login credentials secure and will be held solely responsible for any actions taken using your account", but I haven't been able to find such as clause for this network.

  • 5
    I understand your point of view, but it's a case by case action IMO, as you must understand that some peoples could use the excuse, "my account got hacked" after name shaming/insulting others to try to get their ban lowered, as such the final action must be weighted by a CM with the data they can dig. – yagmoth555 Mar 18 '19 at 17:08
  • 1
    @yagmoth555 right, I'm talking about cases where it is at least fairly clear that a hacker was involved. Is there formal guidance on when it is "fair" to still punish the original user, or is each case essentially its own brand-new universe? – Robert Columbia Mar 18 '19 at 17:09

This is a very rare case, so I doubt there are set rules for it. It'll be a judgement call on the part of the moderators handling the situation. Probably moderators will seek help from community managers to better understand what happened and (if applicable) to disassociate flag-deleted posts. (Moderators can't do that.) Besides, mods have heard "I was hacked" a lot of times where that's very unlikely to have been what happened; we're going to ask for CM help to investigate.

If moderators think an account (with otherwise positive activity) has been hacked and damage is ongoing, they'll suspend the account right away to stop the bleeding. Suspensions can be lifted early if the vulnerability is addressed. Addressing other on-site consequences (such as rep penalties) would very much depend on what happened and what the user, once aware, did about it. (I saw a case once where the user reported the hack and asked for a short suspension to sort it out. There was no lasting damage in that case.)


What we can do to an extent is limited.

If you feel/suspect that your account has been compromised, you absolutely need to use the contact us link immediately as soon as you notice something wrong, and let the SE team know. Its probably helpful if there's a clear idea how a compromise happened. We've heard stories both plausible and fantastic.

If you're a user in good standing - our Immediate reaction would be confusion. We'd likely suspend your account to cool down/work out what happened, grab the brain trust - both in terms of local mods and CMs, with the possibilty of advice from non local mods if they know the person involved.

We have a few tools to deal with

because you left your account logged in at a public library where the spammer found and took advantage of it,

(and its unlikely it would be a spammer. Spammers are organised these days, and often either big sweatshops or automated. Some bored kid posting LOL ***** is more likely)

Its certainly unlikely we'd take the "its your fault" tone too.

So, be honest, help us with as many details as you can, and if its clear that someone else compromised your account - we could probably try to help deal with the damage. If it keeps happening... well...

But sure - clearing red flags for spam and trolling is an option if it was clearly and unequivocally not the account owners fault is an option.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .