@Tashaj
Considering the breach, I see you have now dealt with it, or will have when you establish the Payment PIN.
In the old days, you had a fighting chance of see where the breach was from the Devices tab in your account, but this is probably no longer effective. Something Now could usefully revisit and put back how it used to be 😢
There are two principal ways that somebody else could have bought a Membership on your account:-
(i) They went in on a TV or other device of yours that has a persistent login (i.e. not a phone, tablet or laptop/PC/Mac) and simply took out the Day Sports Pass and Boost.
(ii) You disposed of such a device, without a Factory Reset to wipe it first, and somebody obtained it and used it.
In both these cases, a Payment PIN would have prevented this. And in both these cases, they did not need your password, and so will not have breached it.
But as you did not know the exact source of the breach, changing your password was a necessary precaution, because:-
A third way, much rarer, is if somebody knew your login and password, and signed on to any device anywhere that runs Now, with those details.
A Payment PIN would have prevented the purchase even here, as even having all your account details wouldn’t allow them to learn, or to change, what the PIN was.
Just changing your password does not stop users who were logged into your account on persistent devices from continuing to use them. This is why the step to log off all users, after changing your password, was necessary.
You should be pretty fireproof now, but never tell anyone your Payment PIN, unless you are prepared for them to buy Memberships on your dime, and your password likewise.
Set a Payment PIN on your account so that no-one but you can buy memberships on it. Check your bank accounts monthly for any other unexpected payments to Now. That way you can at least nip them in the bud, while you and Now figure out whose fault they are.
