Comments on: Unauthorized Payment Done With My PayPal Account

By: Sinfullygorgeous

Sinfullygorgeous — Sun, 13 Sep 2009 23:38:29 +0000

I’ve just been duped for $898NZ to someone in Italy. The bank can’t cancel the payment from this end…WHY WHO THE HELL KNOWS!!!!
And haven’t been able to cancel my credit card yet, as they want to see if the transaction goes through! FREAKIN’ BRILLIANT! i have had no response from Paypal. I ripped it up them for the rent and told them that under no circumstances did I authorise any payments and to cancel my account! It seems this happens alot so don’t use paypal!

By: Terry

Terry — Tue, 09 Jun 2009 19:07:00 +0000

I know it’s been a while since the last post but this seems to still be going on. Today I had 7 unauthorised payments from my Paypal account, all to items on Ebay.de.
Sent the form to paypal but like most other victims I have no clue as to how the account was compromised.

By: SisXtian

SisXtian — Thu, 19 Mar 2009 23:19:26 +0000

Get a PayPal security key and don’t keep any money in your actual PayPal account. Link it to a credit card. Since I did that, I’ve had no worries… at least not with PayPal. :)

By: Kyle Elizabeth Wilson

Kyle Elizabeth Wilson — Wed, 11 Mar 2009 05:13:23 +0000

Same thing just happened to me! They bought on ebay a pair of baby clothes for $80 and added $20 shipping…then they bought an antique rug for $90 and added $10 shipping. Both transactions show up with Chinese character symbols in the name field in paypal. Very bizzare…I also have a ship to address “Sarah Sexton 8 Broadway Ave Latham NY” …no clue how the eff they did this…and who the eff they are! ughh…i just hope for now i have enough to cover that rent check and bills check that will clear any day now from my accnt. this sucks big time.

By: Gopal

Gopal — Mon, 20 Oct 2008 15:32:57 +0000

anyone who knows your phone number and mail ID can change your password through forgot password link and change the password unless you keep everything including your phone number, address and email ID a secret. But they are for others to use after all.

By: PayPal Account Hacked « Journey of a Serial Entrepreneur

PayPal Account Hacked « Journey of a Serial Entrepreneur — Wed, 17 Sep 2008 13:17:36 +0000

[...] key to safeguard your account from similar activity. This is not an isolated case, I found this article which goes to show that there is obviously a significant loop hole somewhere in the system, and it [...]

By: Never gone say my name

Never gone say my name — Sun, 31 Aug 2008 15:44:15 +0000

ha ha ha ha ha i guess thats what happens when people on youtube goto my vids about hacking. I did the same to some other guy. but i dont think i did any of you guys sooooo probably someone saw my video and did it thats funny how lots of people can do it

By: matt

matt — Sat, 16 Aug 2008 04:38:08 +0000

I just had the same thing happen – the catch is I havent used paypal in over a year. This would seem to rule out spyware. Any ideas?

By: lara

lara — Tue, 29 Jul 2008 11:58:05 +0000

HI, same thing happened to me this weekend. $2000 out of paypal acct. I believe it is internal problem at paypal… they acted on the phone like they are seeing this problem a lot this month. My system and network are solid.

By: Cobe

Cobe — Wed, 23 Jul 2008 14:20:35 +0000

Same exact thing just happened this morning for $410. Here is a list of the companies below.

Jul. 23, 2008 -$180.00 USD Gaming Resources LLC
Jul. 23, 2008 -$180.00 USD Gaming Resources LLC
Jul. 23, 2008 -$50.00 USD aeRO Gaming

By: PillolHacking.Net » Come vivere (e bene) senza antivirus

PillolHacking.Net » Come vivere (e bene) senza antivirus — Mon, 21 Jul 2008 03:22:02 +0000

[...] giorno fa è accaduta a Martin Brinkmann di ghacks.net una singolare sventura: dal suo conto paypal sono stati proditoriamente prelevati a sua insaputa [...]

By: Ghacks.net DE » Blog Archive » VeriSign Identity Protect Und PayPal Sicherheitsschlüssel

Sat, 19 Jul 2008 10:00:38 +0000

[...] by admin under Hardware, Sicherheit Ich hatte vor kurzem ein sehr unerfreuliches Erlebnis mit PayPal bei dem das gesamte Geld ohne meine Zustimmung von meinem Zugang überwiesen worden ist. Eine der [...]

By: Protect PayPal Accounts With VeriSign Identity Protection Devices

Protect PayPal Accounts With VeriSign Identity Protection Devices — Sat, 19 Jul 2008 09:37:17 +0000

[...] had a rather unpleasant experience with PayPal lately where someone transferred all the money from my account. PayPal was not very forthcoming and [...]

By: francois

francois — Tue, 15 Jul 2008 14:12:55 +0000

@SisXtian

“”"
My point was that regardless of keyscramblers and unique passwords, your PayPal account can still be hacked!
“”"

Sure, every systems can have flaws. I was talking about the “educate” part for the 99.9% of computer users who still don’t care about (unique/password strength) for a sensitive websites or don’t know what a key logger is. As a software developer I just say it is *extremely easy* to write a new keylogger on Windows, just plain *extremely easy*. The first step to avoid a danger is to know its existence. From that point people do what they want, I really don’t mind.

“”"
There are plenty of programs out there that will brute-force figure out your password… no matter how unique it is.
“”"

Sure, but after my death I don’t really care. The stronger a password is the longer it will take to crack (assuming it wasn’t a key logger).

“”"
Bit strength can be calculated by taking the total number of possibilities for each character in a proposed password, and multiplying by the total password length.
…
Currently, distributed.net estimates that cracking a 72-bit key using current hardware will take about 403′784.9 days or 1′105.5 years.[7]
No currently expected increase in computer power will be sufficient to break 128-bit or 256-bit encryption using random keys via a brute-force attack.
“”"
http://en.wikipedia.org/wiki/Password_strength

This numbers assume you have a local access to the users’s data. Through the internet the delay between each try will probably give you times much longer than the age of the universe itself and you’ll quickly run into a “denyhost” anyway.

Assuming that password strength is not important for a sensitive service is IMO a bad idea for “educating” people to security.

If cybercriminals retrieve the users database of a popular service (like for example a php forum through an SQL injection if there is a security flaw), they can then brute-force the weakest passwords. With the retrieved login/mail/passwords they can try other popular service like ebay/paypal/etc and since lot of people keep the same login/password for a sensitive service…

Cybercriminals search for the easy catch first, they are not going to spend few years to crack a strong password, time is money, simple business logic.

By: Jojo

Jojo — Tue, 15 Jul 2008 10:35:10 +0000

I got my new Paypal/eBay security key the other day. I don’t think anyone will be able to easily hack an account using a security key.

Who knows, maybe there is someone inside PayPal that can compromise an account? Who knows how strong PayPal’s internal security is or if anyone really reviews logs?

Again, given that we don’t know how this (or other) break-in’s are really accomplished, I’d highly recommend getting the security key.

By: SisXtian

SisXtian — Mon, 14 Jul 2008 23:19:44 +0000

My point was that regardless of keyscramblers and unique passwords, your PayPal account can still be hacked! My password was very unique, long, and used numbers and letters. The person who recommended doing a search on YouTube for instructional PayPal hacking videos was right. There are plenty of programs out there that will brute-force figure out your password… no matter how unique it is. Since it doesn’t seem like someone physically stole my password and logged into my PayPal to make an illegal transaction, the next logical choice would be that they used one of those programs to hack the password remotely. There must be some backdoor vulnerability that some of these programmers figured out too. I hope PayPal gets their security in order. But for now, I’m clearing my account.

By: francois

francois — Mon, 14 Jul 2008 20:42:00 +0000

“”"We should keep this thread going to educate people about what’s going on and what they can do to prevent it/get their money back.”"”

Concerning the “educate” part, as I said in my comment above, it is extremely easy to write a new keylogger on Windows which will then be undetected (I would say 30 minutes for a ‘reasonable’ student beginning programming). I think the best way to avoid them is to assume there is always one lurking around (and use a keyscrambler for example).

Also concerning paypal my password is unique (not used on any other website or application), long, using also numbers and special characters.

By: SisXtian

SisXtian — Mon, 14 Jul 2008 19:49:02 +0000

I’ve just had this EXACT same thing happen to me… except the amount was for $1200 USD sent to a UK e-mail address. Of course, the first thing I did was report it as unauthorized on the PayPal site, change my password and questions, and scan my computer for trojans. Everything turned up clean. Did you find out if PayPal had a record of someone logging into your account from another IP address? I’m very curious as to how this happened as well, as it seems it happened without someone logging in. My dispute is still pending. The process PayPal goes through is to contact the recipient and have them confirm that the payment was unauthorized or something. And today, the guy e-mails me asking me to remove the dispute and he will refund the money to me, as this is all a nightmare for him… for HIM?!?! No way in hell I’m removing the dispute. If he’s innocent, he has nothing to worry about. It’s also been recommended to file a police report. We should keep this thread going to educate people about what’s going on and what they can do to prevent it/get their money back.

By: Tom Davison

Tom Davison — Tue, 08 Jul 2008 08:56:25 +0000

I have just had this done twice, I have paypal linked to my hotmail account and it had the same password (this is now not the case) they took about £400 both time’s i didn’t notice the first one as they must have logged into my hotmail account and deleted the notifications, but the second time i was at work and logged into messenger and noticed an alert pop up from paypal about a payment, this was a bit of a shock.

I don’t normaly have any money in the account so they took it off 2 card’s i have stored in paypal

the person left a few days between each payment, fortunatly I have now notified paypal but i don’t know how long this is going to take.

Tom

By: lucio ribeiro

lucio ribeiro — Thu, 03 Jul 2008 07:56:30 +0000

Martin, long ago I remember a plugin for firefox (sorry mate cant remember the name) that would give you the username + coded password, then you can use a force cracker to fin out,
More or less like google syntax:
inurl:_vti_pvt”service.pwd”
cheers
Lucio