PayPal Digital Gift Cards code leak
PayPal is not only a dominating force when it comes to making online transactions between individuals and companies, it also branched of in other areas such as gift cards.
You may visit the site PayPal Gifts to purchase gift cards for various popular online and offline services using a PayPal account.
The service has a security issue currently that is caused by an improperly configured server, or more precisely, a robots.txt file.
Basically, what happens is that search engines index the "here is your PayPal gift card" pages on the site. These pages show the code of the gift card among other things. This means that anyone may use the code to grab the credit before the recipient may have a chance to redeem it.
Good news is that only a handful of pages are indexed currently by Google. The main reason for this is that the gift pages are not linked anywhere on the PayPal Digital Gifts site. This means that they can only come in the index of they are linked from a location that search engine bots have access to.
Customers who purchase gift cards using PayPal's Digital Gifts service need a PayPal account for that. Recipients on the other hand don't. They can take the code and redeem it directly using the service it was created for.
The service supports a wide variety of popular online services including iTunes, Google Play, Best Buy or Apple Music.
A robots.txt file is used by webmasters to "tell" search engine bots what they can and cannot crawl on the site.
The theory is that search engines ignore any "forbidden" area as indicated by the file so that it is not indexed.
Something that is not indexed cannot come up in the search results. PayPal on the other hand redirects the robots.txt file which means that it does not use one on the site.
While fairly limited in scope, it is an issue nevertheless, and one that does not paint PayPal in a kind light.
Take away: if you get a digital gift card, redeem it right away. If you buy one, make sure the recipient does so to avoid any issues with the information leaking online.
Now You: Do you use gift cards?
This has blown up.
I can see more victims coming forward once the shopping season goes into full swing.
http://slickdeals.net/f/9095623-psa-check-your-balance-for-paypal-digital-gifts-bought-from-ebay-your-digital-gift-cards-might-have-been-comprimised-and-have-an-0-balance?v=1&p=89973647&comment=success#
I think the leaked cards you can see on google was just a test by the crooks. The hack was much larger than this and thousands of people who bought gift cards on paypal are having their gift cards stolen:
http://milestomemories.boardingarea.com/paypal-digital-gifts-hacked/
Explaining how this works seems… dubious. Granted, most of the time if people REALLY want to do things like this, then they’re probably aware of potentially even better ways to acquire the info they desire but still, having something like that graphic up essentially detailing it seems not good. But, this isn’t my site and it certainly isn’t my article, so my criticism of how information is disseminated through such things is rather worthless.
As to the larger issue at hand, I have to assume SOMEONE involved with both the card site and Paypal is aware of this. Potentially to the end that any accounts redeeming the codes get flagged for review and if it’s determined that a single account has used a massive amount of redemptions in such a short period then the account could be closed without issue (or some other action taken).
“any accounts redeeming the codes get flagged for review”
Chains, you’re missing the point (the point of “Why would anyone purchase a PayPal gift card”).
The gift card mechanism is provided to accommodate the scenario where the intended recipient doesn’t have a PayPal account, or for reason of anonymity the prospective recipient doesn’t wish to REVEAL to the sender his email-address-of-record.
Never & never use paypal or any other form of online money transfer. Too dangerous especially here in Asia
I’m saddened to to hear that.
I’m in USA and (trading with other USA paypal users, via ebay and other ecommerce venues), across the past decade, across well over a thousand PayPal transactions… I’ve never encountered a bad incident.
Just send the money via Paypal to the email address. Paypal will then notifiy them and they can create an account with that email address.