Heads up, PayPal users

Vanity | Conservababe

[Conservababe]

After many years of having an account with PayPal, I am sorry to say that I no longer trust them.

In the last few days, someone hacked into my account and added a bank to my list. They then proceeded to deposit money into my account using this bank and then withdrew the whole amount after two days. All this was unknown to me as I have not had activity using PayPal in months. I only caught it because of notification sent by PayPal in e-mail. I suppose I should be grateful for that.

So, I called PayPal and began a long process. They verified that my account had been hacked by someone doing transactions on e-bay. They assured me that the person had no chance of finding out the number of my own account but they had just used my account for money laundering, so to speak. My own little amount in the account was not touched.

I am unsophisticated about finicial dealings but my first instinct was to cancel my account immediately. I was told that they would put a limited access but they could not cancel because they would have to engage in an investigation. I then changed my password and all the security questions. A few hours later, I signed on using my new password to find that I could easily take off the limited access by merely changing my security questions.

Well, that just made me downright mad. I called them again and demanded that my account be closed immediately. Do you know that I finally had to threaten them with calling my State Attorney General, Jay Nixon before they would cancel. Finally, they did.

I suppose now all I have to worry is that someone might have stolen my idenity!

[stylin19a]

immediately alert the Feds...

[FairOpinion]

Thanks for sharing your experience.

If someone hacked into your accout to add a bank, put money in and take it out, I don't see how they couldn't have seen everything else in your account.

I think you did the right thing by canceling your account.

I never used PayPal, so I don't know how it works, whether you actually put in your bank account/credit card numbers to fund your account, but I would keep a close eye on your other accounts, and even consider changing those account numbers, most banks cooperate in closing one account and open up another one with a different number, for security reasons.

[jbstrick]

How did they guess your password? Was it secure enough?

!29#$df<.Jr7%$78()=3Fghf

^^ That is a secure password.

[FairOpinion]

Who to Call to Report a Financial Crime

http://www.fdic.gov/consumers/consumer/news/cnspr03/call.html


If you think you're a victim of a financial crime or if you notice anything suspicious, immediately get to the phone and call:

The police. Get a copy of any police report or case number for later reference.
Your bank, credit card company or other financial institution that may need to know. Close accounts that have been fraudulently accessed or opened.
The fraud department at any one of the three major credit bureaus—Equifax at 800-525-6285, Experian at 888-397-3742 and TransUnion at 800-680-7289. The credit bureau you contact will share the information with the other two and a "fraud alert" will be placed in your credit file at all three companies so that lenders or other users of your credit records can avoid opening a fraudulent account in your name. You'll also receive a free credit report from all three companies so you can look for fraudulent entries. The three companies also pledge to work with you to delete any fraudulent information in your file.
Note: If you become aware of anyone using your identity, also notify the Federal Trade Commission (call toll-free 877-ID-THEFT or 877-438-4338, or go to www.consumer.gov/idtheft). The FTC shares complaints with other law enforcement agencies.

[alloysteel]

Well, here's the thing about PayPal: Even when you demand the account be closed, shut down, abolished, AND terminated, they just place it in a dormant mode. Then six months or a year later, it jumps up to bite you in the gluteus maximus, and you get this mysterious e-mail, asking your "status". I made the error once of replying to this request by entering entirely bogus information (home address, password, but NOT any information about credit or debit cards, real or bogus). That probably stopped the "phisher" about 0.02 nanoseconds, then the barrage starts in again.

Anything from PayPal is now automatically spam.

[Conservababe]

Thanks, I never thought about contacting the Feds. My bank nor PayPal suggested this. I am going to do so right away.

[Old Student]

I would suggest you're a slow learner, but it may just be because you had good experiences up until now. I canceled my account about 3 or 4 years ago, when they changed the agreement to make themselves not at all responsible for anything done to your account without your explicit permission, and removed your right to sue. When I use ebay, I specifically refuse to do business with people who only accept paypal.

Our situation was that they had double paid a vendor for a wheelchair we bought from ebay. It took several months to get things straightened out, and if the vendor hadn't cooperated, we might NEVER have gotten our $180+ back. Among other things, Paypal refused to acknowledge that they had paid the guy twice, even with his correspondence to support us. IIRC, in fact, the vendor sent us the money, himself, because Paypal wouldn't. They wanted to deposit it in our paypal account, and force us to keep it there for several more months.

[Philistone]

Interesting. I have a solution for bullet-proofing credit card transactions over the Internet, but every VC I have talked to so far just looks at me and says "PayPal".

Guess I just have to keep looking.

[Star Traveler]

Well, that's not the only problem with PayPal --

http://www.paypalsucks.com/

I won't do business with them. Too many other people have told of how their money was taken and frozen and not handled in a professional manner. They are not a bank, and so they don't even have to handle your money in any rational and "bank-like" manner. They are "frivolous" in their handling of people's money.

Deal with a bank, instead.

Regards,
Star Traveler

[freedumb2003]

^^ That is a secure password.

I know you are just joking but let me add some real-life Security Administrator experience. If you are a clerk and have a password like that, what do you do? You write it down on a little sticky note and slap it on the side of your monitor.

Those rediculous overly-comlex password rules make network admins and novice security administrators feel good about themselves but are counter productive.

Now back to the Steelers' game.

[diverteach]

Question for you. Have you ever recieved what LOOKED like an authentic email from Paypal to the affect that your account was suspended until you provided them with an update of your information?

These emails looks 99.9% authentic from Paypal, but they are not. The only clue is 2 different digits within the URL address string the email links to. Th only other clue would be to know that Paypal NEVER asks for this information.

I've recieved many such emails, but I know better and I could easily see where many would not. Every one that I forwarded to the Paypal fraud department, Paypal would email me back confirming the fact that they were fraudulent.

If you ever recieved and responded to one of these emails, thats propbably how you've been compromised.

[Conservababe]

Yes, you have to give your entire bank account/credit card numbers when you sign on the PayPal. After that, the only numbers seen on the screen is the last four numbers, which is supposed to be protection.

[MizSterious]

Just so you know, this can happen with virtually any online banking account. If there are safeguards, there are hacks around them.

Some of the things I've been advised to do are: always make sure you log out of your account on your banking sites when you're done--and then close the window you were using. Check in with the site(s) from time to time and look at the history. Never click on an url in an email purportedly from the site (PayPal is one of the main targets for "phishing"). If you want to make sure the note is legit, enter the url by hand. Nine times out of ten, any note from those places asking you to log on and give personal information are frauds.

It's not only the banking sites though. Last week I got a note supposedly from my isp asking me to click on the link and re-log in or else my email account would be cancelled. The site I would have gone to if I had clicked was NOT my isp's site, and my isp never sent the email.

The internet is not necessarily a friendly place--you need to take all the safeguards you can, just as though you were walking to a favorite restaurant by way of a rough section of town. There are plenty of would-be muggers and purse-snatchers who are looking for easy marks.

[pabianice]

Check with DNC Headquarters...

[Conservababe]

No, I guess I did not have a secure enough password as it was hacked. I changed it every few months or so, though.

But, for all I know, it might have been someone who works at PayPal itself. How can one protect against that scenario?

[mwyounce]

!29#$df<.Jr7%$78()=3Fghf

^^ That is a secure password.

Not anymore it's not! How'd you get my FR password anyway?!?!?!

[Conservababe]

Thank you so much for all this information. I will follow through tomorrow.

[BallyBill]

I've noticed in the last few weeks the Internet is starting to go to crap again. Things had sort of calmed down for awhile, but the spam and other crap is on the rise again.

I also think some new advertising methods on the web are really causing problems. I run some extra ad blocking software and it has been going crazy lately on some sites that didn't used to be a problem.

[ducdriver]

I got one of those e-mails. It would accept any bogus (or real) information, and lacked the secure url designation (https://) as well. I figured it out just before I nearly sent my real information, and notified Pay Pal. Changed everything, too, just in case. Another thing was that the e-mail did not mention my name, as Pay Pal is supposed to do, and it asked for personal information that Pay Pal has never sought.

[marajade]

When paypal caught it, did you get your money back?

[Maelstorm]

So they are still at it? I had a problem a few years ago back when they were still claiming to be insured and that verified users could be trusted. I had to fight them for almost a month and get the SEC involved but things worked out in the end in my case. I do think they have improved the way they do things but all online money services have a way to go before they have the level of security they should to protect users. At least they aren't stonewalling like they used to.

[balls]

Pay Pal is quite a sleezy operation. I called to cancel my card last week and found out later that all they did was transfer the account to Washington Mutual, which I have never heard of. Now I have to go through the cancellation process all over again. Of coures, they expect that I won't bother going through that headache and will eventually use the card. They are wrong.

[Conservababe]

No, I never respond to any link that advises me to update or such. I always type the address in the url space to access.

[BunnySlippers]

Scarey ... especially since my balance is not so small. Now that I think about it it would probably be good to have a second, tiny account for PayPal transactions.

Remember, you can also have your bank change your account number if you want to be safe. You have to get new checks but ...

[Bogey78O]

Yup. My company has a 30 day password rule. So what do guys do? They write it down because they can't remember a 8 digit password that requires letters, numbers, and symbols every 30 days. Not to mention there's about 4-5 different ones for each of the different system on the intranet.

[1066AD]

Exactly. Mouse over the reply URL and it's usually pretty obvious it's fishy (phishy).
Most of my pseudo PayPal "alerts" come to an address different from the one I use with them.

I've never had any problems with PayPal but then again I'm not a heavy user and the amounts invloved are usually well under $100.

[Conservababe]

I actually did not lose any money, as far as I know now. They just used my account to add another account, unknown to me, and did the transaction through that account. They left my little amount in my true account alone.

I was told that it is money laundering, so to speak.

[FlingWingFlyer]

I get spam everyday from "PayPal" telling me that they are going to "suspend" my account if I don't go to a certain website and provide them with my life history. LOL! I don't even have a PayPal account. I do not respond to ANYTHING via email. If someone needs to contact me, they can send me a letter in the U.S. mail. Computers are a bad way to do business these days. Although I do buy stuff from ebay, I always use Postal Money orders. I don't trust ebay. I once changed my email address because I was receiving too much spam. Ebay was one of the very few people I notified about my email address change. No later than two to three hours after I emailed them with my new email address, I started receiving "phishing" spam about my ebay and PayPal accounts.

[freepertoo]

I've never had problems with PayPal after many years of using them. I don't respond to emails from so-called Paypal addresses or ads...they are bogus. So far, no problems. I've been satisfied...so far!

[marajade]

But paypal caught it though right? Are they taking legal action against the perp?

[BunnySlippers]

I have never had a problem either and I use it often. That is not to say it is safe.

[Conservababe]

No, PayPal did not catch it. I did, by finding e-mail from them as though it was a normal transaction on my part. When I called, I was transferred to security who said that it had been hacked. How they could tell, I don't know. But, no, they did not notify me that it was a questionable transaction.

[marajade]

Thanks for the clarification. Thanks. My husband's account was accessed the other day and someone posted some auctions using his account and redirecting the money to that other poster. However, ebay caught it.

[Conservababe]

Which reminds me, I am closing my e-bay account, too.

[the Real fifi]

PayPal contacted you by email? I don't think so. I get dozens of such emails everyday --from hackers. If you respond to their emails and give them your password you can bet your account will be cleaned out.

[gotribe]

Congratulations on your wealthy retirement! Wish they'd hack my account.

[ncpatriot]

Off topic: what's the score?

[struwwelpeter]

Four or five years ago Paypal decided they wanted to hold onto about $5000 of my money without explanation. The MN state attorney general managed to pry it loose, but it took 3 months and wiped out what was a promising online business of mine.

I'd kiss Osama bin Laden on the lips before I'd do business with Paypal again. Just seeing the Paypal logo on a site makes me look elsewhere for what I want to buy.

[joshhiggins]

!29#$df<.Jr7%$78()=3Fghf

That's my password!

[Conservababe]

PayPal does notify by e-mail of every transaction. It says in the e-mail to notify them if there is any problem. They never ask for passwords and warn that the correct url must be in the address for contact. I always typed it in manually to access my account.

Not that this excuses them by allowing my account to be hacked. LOL

[theymakemesick]

IIRC, PapPal has a system in place where if you want access to all of your account's funds without time restraints or cost to you, you have to verify your bank account. I don't remember the exact numbers but I think you can only have =< $500 sent to your bank in a given month unless you verify. To verify your account, PayPal will place two very small deposits into your bank account (< $1.00). You check your bank account to see how much the deposits were for and confirm the amounts with PayPal. This reasonably proves that you have access to the account they will be transferring to. After you complete the verification process, you can have > $500 deposited into your bank account at any time you request it.

Perhaps the perps thought they would just monitor your small account waiting for a large deposit and then clean it out.

Cheers

[SuziQ]

Wouldn't Pay Pal have contacted you to let you know about the activity on your account? Even when we've just gone in and changed the password on ours, we've immediately received an e-mail informing us of the activity on the account so that we can be assured that no one has done something without our permission.

Of course, we've received Phishing e-mails from time to time that looked like it was from PayPal, asking us to log in because of suspicious activity. Might you have responded to one of these, not realizing it wasn't from PayPal? This would have given someone access to your account, unbeknownst to you. When I receive anything unsolicited from PayPal, with any sort of inquiry, I always check our account, first, then contact PayPal directly through their website, which I logged onto directly, then forward the suspicious e-mail to them.

[Fresh Wind]

Be aware that "paypalsucks.com" is promoting an alternative payment scheme via links that appear throughout their site. Every post on their forum contains that link. They are making money by promoting the notion that PayPal is the worst thing short of a Clinton landslide. I'm not saying that PayPal doesn't have problems, but you have to be wary of the ulterior motives the people operating a site like this.

[longshadow]

When I called, I was transferred to security who said that it had been hacked.

IF you got the phone number from the e-mail, it's likely it wasn't really Pay Pal you were talking to, but the PHISHERS who used the ruse to obtain your account info.

IF you got the phone number from genuine Pay-Pal Documentation, or the genuine Pay Pal Website, then you may be safe... for the moment.

[Random Access]

!29#$df<.Jr7%$78()=3Fghf ^^ That is a secure password.

That would have been my second guess.

[photodawg]

Which reminds me, I am closing my e-bay account, too.

''''''''''''''''''''''''''''''''''''''''''''''''''''''

I have had problems with e-bay and pay pal. E-bay is prone to fake e-mails saying that an item you lost to a higher bid, is now available to you but you must complete transaction through wire service.

Pay pal scams generate as an attempt to add an e-mail address to your account and please notify us if its OK. Its not from paypal however its from someone trying to get you to login to what you think is paypal to prevent the additional e-mail When you do the hackers get your paypal account information.

[free_at_jsl.com]

I'm pretty sure the Google's terms of service prohibit the selling of a gmail address.

[Tarantulas]

I've also never had a problem but I don't use it all that often. I get tons of eBay and PayPal spam but I never answer any of it.

For every PayPal horror story there are probably a thousand users who think it's great.