My paypal was hacked yesterday

[skilly1]

So I suddenly receive 250 official emails from various companies saying I have signed up to their newsletter.

Then (luckily) my paypal app pinged on my phone for transaction of £1400 for currys pcworld.

The signup emails keep on coming (now up to 400) and I get another ping for £1400 going out.

Obviously I got in touch with Paypal and sorted it immediately.

So the scam is they hope you wont notice your Paypal transaction emails within the 500 they send you.

So if you suddenly get 250+ sign up emails you know what's going on!

Clever but how did they get my papal password. Its randomly generated, I have never typed it in (I use password manager) and my password manager log does not show any access I did not know about. Hmmmmm….

[jesusbuiltmycar]

May be worth turning on 2FA for Paypal with Authy/Google Authenticator etc.

See:

https://www.paypal.com/us/smarthelp/article/how-do...

[skilly1]

Thanks. Will take a look.

[Dogwatch]

I use 2FA. Bit more faff but worth it imho.

Only thing to watch for is if the code is a little slow arriving so you repeat the request. Then two arrive and you have to decide which one their computer is going to accept! Be patient.

[jesusbuiltmycar]

Dogwatch said:

I use 2FA. Bit more faff but worth it imho.

Only thing to watch for is if the code is a little slow arriving so you repeat the request. Then two arrive and you have to decide which one their computer is going to accept! Be patient.

If you use 2FA via an app instead of SMS it is more secure and you don’t have that problem.

[w1bbles]

I had my PayPal account hacked last year in similar circumstances - never type in my password, use a randomly generated complex password through a password manager etc. They never did explain how it might have happened but I did get my money back. There were 2 transactions ramping up in size so I suspect they were going to go for a bumper one next!

[Alucidnation]

I guess it wasn’t going to be long before even random password generators are no good.

How long before 2FA gets the same?

What then?

It’s all very well having Touch ID but you still have to have a password set up.

[jesusbuiltmycar]

See also:

bgr.com said:

One more important point to note is that hackers likely used information about Krebs that’s publicly available to social engineer this hack, so chances are it won’t happen to regular Joes and Janes, assuming their personal data including Social Security numbers and credit cards aren’t out in the open. But, again, it’s PayPal’s job not to allow this kind of breach.

It seems that the hackers did not use malware or any advanced virus programs to steal Krebs’ PayPal account and password. They simply called in, offered the SSN and the four numbers of an old credit card account, and got in.

https://bgr.com/2016/01/04/paypal-account-security-hackers/

[outnumbered]

jesusbuiltmycar said:

May be worth turning on 2FA for Paypal with Authy/Google Authenticator etc.

See:

https://www.paypal.com/us/smarthelp/article/how-do...

This doesn't apply to consumer Paypal accounts. They only support SMS-based 2FA with those, not apps.

[mikeiow]

skilly1 said:

Thanks. Will take a look.

w1bbles said:

I had my PayPal account hacked last year in similar circumstances - never type in my password, use a randomly generated complex password through a password manager etc. They never did explain how it might have happened but I did get my money back. There were 2 transactions ramping up in size so I suspect they were going to go for a bumper one next!

Which password manager/s do you use?
Curious if there are loopholes in any....

[anonymous-user]

do you use public wifi?

[Brainpox]

Alucidnation said:

I guess it wasn’t going to be long before even random password generators are no good.

How long before 2FA gets the same?

What then?

It’s all very well having Touch ID but you still have to have a password set up.

2FA still has huge scope for development. I don't think we need to worry about it being useless for a while yet.

[jesusbuiltmycar]

outnumbered said:

This doesn't apply to consumer Paypal accounts. They only support SMS-based 2FA with those, not apps.

I use Authy with Paypal and only have a basic Paypal account...

[okenemem]

this is very concerning , how were PayPal in terms off refunding the money, simple??

[okenemem]

omg

[mizx]

Mine/ebay was hacked 6 years ago, some Lithuanian bought various camera gear totalling 4 grand - shipped to a camera shop over there... First I heard of it was from the bank that my card was overdrawn. Paypal were very good sorting it - I phoned support in Ireland IIRC.

second thoughts whether I should add what I posted earlier - deleted it I have mentioned it online before though - was a long time ago and I never heard anything back

Edited by mizx on Friday 8th March 22:19

[skilly1]

To answer some questions-
I use LastPass
PayPal refunded straight away

I dont think they hacked my lastpass account as would they not try and log into loads of accounts - amazon etc?

Also not sure they hacked PayPal, again would they not change the password straight away to lock me out ?

I have no idea what they did to get in tbh.

[bitchstewie]

Who do you use for email and what's the setup?

What devices do you use?

[Fore Left]

jesusbuiltmycar said:

I use Authy with Paypal and only have a basic Paypal account...

Really? How?

[skilly1]

bhstewie said:

Who do you use for email and what's the setup?

What devices do you use?

iPhone, Microsoft surface. Microsoft office outlook 365. Email is handled by our website company, they use amazon servers.