Comment by JohnMakin

Same happened to me, but by the time they gave me my account back (though now “unverified”, even though I had to scan my DL for them to unsuspend my account - and even though I was premium and verified before the suspension btw - though the hatred is still there, the rage-motivation to document the insanity had devolved into apathetic sadness (with much help of the general state of the current incarnation of the job market) so I’ve said nothing until this meager reply.

But specifically, what had occurred was that I noticed I had nearly fallen for an LLM-bot clone or takeover account from my contacts in my DM directing me to this “great recruiting firm” that looked to be just an identity docs siphoning scheme.

That caused me to notice a bunch of new 1st-degree connections I hadn’t added, all of which were profiles purporting to be Chinese AI researchers. No clue if they were real people and I didn’t spend time to investigate before doing exactly what you describe - change of password and enable 2FA, with the added step of trying to report the suspicious circumstances to the obvious security@ etc email addresses… ALL attempts of which bounced with messages telling me to use the LinkedIn platform to report security issues, as those email addresses are not monitored. (lol)

Of course, when I reluctantly tried to capitulate and report the matter using the links from the bounce messages, I found I could not, since my account was suddenly suspended for “suspicious activity”, and the kicker was that in order to unsuspend it, they wanted me to upload scans of my government ID! Yes, they wanted me to do the suspicious sort of activity I was wanting to report was happening on their platform in order to use the very platform I suspected someone had already pilfered my identity through. I waited a week or so, too disgusted and angry and ready to write them off until, well.. oh yeah, a job. my contacts. sigh

Of course, that’s also another example of the insecure patterns companies force on their users and employees while at the very same time giving them training to not do exactly those things, and exhibiting all the red flags they point out the employee needs to be aware of as indicators of phishing, etc.

I was with a company that outsourced their security policy training and compliance to a company that sent “URGENT” emails from phish looking custom domains incorporating our company’s name, and all the other red flags that told me not to do the things it asked. (so I didn’t, and instead reported each one to our internal security team. It was funny until it wasn’t.)

Hey… Nice. There’s that therapeutic rage-typing I never got around to, and this comment almost brings my comment back on topic. I feel a little better anyway. Thanks all!