Is it possible to get past JAG on an unauthorized device?

Ok, well I've just been hacked from a phishing link, I lost b'ween and a few mil in other items in my inventory.

On my email associated with the account, I received 2 JAG requests, one from Lithuania, the other the Netherlands. But neither were read, however the phisher still got on my account.

This obviously goes to show JAG isn't 100% secure.

Anyone have any ideas on how they would have done this? Will they have been able to mask their ip to match mine and login with that?

 

They must have had access to your email, opened the link, and then made the email unread again so you thought it was a faulty system. That's the only method I can think of.

 

I'm not sure that JAG is 100% effective to be honest. I've had JAG enabled and logged in at friends houses and haven't been given so much as a warning. I've also logged in half way across the country and it logged me right in(this happened just once).

 

Perhaps, however if it was phishing they wouldn't know the email to the account as it's a name login, not email account.

I've emailed jagex so lets just see what they say