PayPal WARNING!

Posted by: blythe on 28 November 2006

A WORD OF WARNING !

Yesterday I was checking my bank statement on-line and noticed in the region of £300 had been withdrawn from my bank account for PayPal.

As I couldn't remember buying anything recently, I looked at my PayPal account and sure enough, there was a transaction with a company I'd never heard of.....

A phone call to PayPal revealed that "I" had bought a mobile phone from a company in the USA !! (I might add, it was a pink mobile phone )

Apparently, whoever had hacked into my PayPal account had transfered money from my bank account into my PayPal account to fund the transaction.

Thankfully, PayPal "hold" funds for 9 days before releasing them, so my money is suposedly safe.

I asked PayPal to investigate the matter as surely there would be a delivery address for the phone that was ordered, which most certainly isn't my address!

I wonder if I'll ever hear of the outcome?

I must point out that I'm not really all that stupid and have NEVER responded to any spoof emails EVER.

However, somehow, someone got my account details and used them......

So, if you're like me and haven't ever changed your Paypal password and if you don't have a good firewall and antispyware software, DO IT & GET IT NOW!

I then looked at eBay and found to add insult to injury, that my eBay account has also been hijacked

Someone had listed loads of "Chanel" bags or something, luckily for me, (not sure yet that it's luckily for me) the listing was cancelled by eBay due to the listing going against eBay policy for falsely using brand names or something.

However, I currently can't use eBay and I now have to battle to get reinstated.


Stay safe, Martin.
Posted on: 28 November 2006 by Chillkram
Did you by any chance view a listing then click on a link that then appeared to ask you to log in again?

This is how they gather your account and password details and, if you have the same password for paypal, they would have access to that as well.

This happened to me but I realised what was happening, changed my passwords within seconds of it happening and then reported it, but you see obviously hijacked accounts on there all the time.

Regards

Mark
Posted on: 28 November 2006 by Guido Fawkes
Account names and passwords are a very weak form of authentication - personally I would never use paypal, online banking or any similar service - the risk is too great. It could be secured, but the companies are too lazy or too stingy to bother.

If you must use an online system then make sure you check its digital certificate, if you get an error from it reported by your browser then don't trust it. Use a very complex password and change it regulary. Use a different password for every account - otherwise getting one password compromises everything.

Never click on a URL sent to you by anybody that requires you to authenticate. Type in the appropriate URL yourself.

Avoid Internet Explorer.

Never use an Internet cafe for anything that involves authentication.

I'm totally paranoid about this.
Posted on: 29 November 2006 by Beano
It would be wise to make sure Internet Explorer doesn't save encrypted pages to disk by clicking Tools, Options, Advanced, then scroll till you see, do not save encrypted pages to disk and tick the box.

Beano
Posted on: 29 November 2006 by blythe
quote:
Originally posted by Chillkram:
Did you by any chance view a listing then click on a link that then appeared to ask you to log in again?

This is how they gather your account and password details and, if you have the same password for paypal, they would have access to that as well.

This happened to me but I realised what was happening, changed my passwords within seconds of it happening and then reported it, but you see obviously hijacked accounts on there all the time.

Regards

Mark


Good tip, that "might" have happened but I can't actually recall it being the case....
I hadn't actually used PayPal or eBay in several months as far as I can remember.

Martin.
Posted on: 29 November 2006 by Jono 13
I have to agree with ROTF on this one. Having seen the results of comprosing security close-up I have limited trust in e-bay/paypal and the like.

Jono
Posted on: 29 November 2006 by JonR
Rotten luck, blythe - I hope you get it sorted.

It is because of incidents such as this that I have never set up a Paypal account.
Posted on: 29 November 2006 by Diode100
When I make a bid on ebay, or a payment with Paypal, I get an email confirming the transaction. Did you not get anything to confirm the payment that went out of your account ? If not they must have gone in and changed your account email. Can this be traced ?
Posted on: 30 November 2006 by blythe
quote:
Originally posted by Diode100:
When I make a bid on ebay, or a payment with Paypal, I get an email confirming the transaction. Did you not get anything to confirm the payment that went out of your account ? If not they must have gone in and changed your account email. Can this be traced ?


No, I did not receive any emails confirming account activity, nor did I receive a confirmation email for change of password or anything, so I'm not sure how they did it. Also, because my eBay account is currently suspended, I can't even look to see if they changed the email address or anything!!
When it works, eBay and PayPal are great, but this does dent my confidence somewhat.....