• We welcome content that is not political, divisive, or offensive. If we feel your content leans this way or has the potential to, it may be removed at any time. A hot pepper forum is not the place for such content. Thank you for respecting the community!

Dear Thief Who Emptied Our PayPal Account

This is just crappy! I'm just the payer at PayPal have no idea about the payee process. I'm happy to hear you didn't lose out of $. That would really suck. Hope they catch those evil rats.
 
queequeg152 said:
edit:
id also look very very hard at reformatting all of your computers, its super likely one is infected with some asshole keyloggers. while it is possible to clean them out with av tools... with all the incomprehensible root kits and insanely tenacious viruses ive been told its almost always best to just reformat.
also its probably a good time to update your OS's if possible... if you are still on someting old... windows xp is like 50 years old, and from what i understand, is a very very tempting target given just about every facet of it has been documented and explored for years... and years and years.

look at new passwords for all of your accounts. assume that they had/have the information to all your stuff. check your email accounts for unexplained filters... i understand that sometimes people will use weird filters/ filtering rules to keep email notifications from showing up in your inbox that would otherwise notify you of suspecious crap. you might also want to reset your routers and modems etc to factory defaults considering its possible someone was stealing your info from your network, or was accessing your network and reconfiguring settings to facilitate w/e traffic they want.

if you want to get crazy, you could nuke the drive with software that completely writes over the bits on the drive such that its empties of all data on the drive completely. this is as opposed to low level reformatting that is basically just wiping out the file system and boot sector or w/e, all the existing data is just rewritten as you write new junk onto the drive. i mention this because i think software was demonstrated years back where a virus could essentially survive a reformatting. that being said, i dont bother. im not a tasty enough target for that sort of thing.

i remember way back i had some stupid virus on my unpatched less than legitimate version of windows that i found with wire shark. it was sending traffic through irc? i could see the information it was sending out in plain text from the packets wireshark had captured, what little i could understand was interesting to read.
Click to expand...

+1 to all of this. All of this is great advice.

Generally when it comes time to nuke a hard drive, I nuke it with a 10lb sledgehammer. Hard drives are cheap, no reason to risk it over $40. I am running a fully patched Win7 machine, this is the first OS that I have ever let "auto update". It took me some time to trust it, but MS really implemented it right this time in my opinion. I run a very good firewall/AV that has a native packet capture and real-time data stream monitoring so I am going to be watching very closely from now on. I also sandbox any new executable and made sure nothing was running from the sandbox.

I am fairly certain that however this was done, it was an automated/scripted attack. All of the actions that I am able to track through the various emails and PayPal records, all were timestamped within a few seconds of one another. Otherwise someone was very familiar with navigating PayPal and also very quick with typing. I would not be surprised if I was not the only account targeted.
 
happens hundreds of times a day....seen it, usually comes in waves, they may be quiet for a few days, but it is a continual battle
 
I had someone charge 4 things on my Check card #, the bank called me, asked if I had purchased from BlockBuster or I-tunes lately? I always use the Credit side of my Check Card never the pin, it appears the hackers can gain access to the purveyors who handle the Card machines accounts, some attach readers to the outsides of gas pumps and people use em and see yah cash!
 
Glad you got reimbursed, I can't believe that paypal doesnt have a too many failed attempts lockout wired into their login function. That's just sloppy.
 
theghostpepperstore said:
I am fairly certain that however this was done, it was an automated/scripted attack. All of the actions that I am able to track through the various emails and PayPal records, all were timestamped within a few seconds of one another. Otherwise someone was very familiar with navigating PayPal and also very quick with typing. I would not be surprised if I was not the only account targeted.
Click to expand...

interesting, if that's the case, i wouldn't be surprised if they were just using tables of account/password dumps from hacked email providers. yahoo was hacked not too long ago if i remember right, could be that someone is just blasting all the yahoo mail account info, or other known info dumps into paypall hoping people use identical login info for both...
dosent paypall prompt you for "security" questions if you log in from a different IP tho?
 
[background=rgb(255, 244, 228)]Every week or so I get the password reset request email from paypal. Quite the phrase for someone to figure out and I change it periodically. I just ignore the password reset emails.[/background]
Click to expand...

You should be very careful about these types of emails. I've had a paypal account for probably close to 8-10 years now and never received a password reset email. It is very likely that is an attempted hack trying to get your password.

Another word of caution: read the TOS. I know there are a fair amount of gun owners on this site. Paypal is very specific about what they will transfer money for and firearms or accessories and a shitload of other things ain't on the list. Don't get your account locked, you'll lose your money. Otherwise, like the OP is finding out, they are pretty safe with your money and I have never had any issues with them as long as you know what to look out for.
 
Yes! They never send password reset emails, those are hackers.

I got this one a few weeks ago:

"Your account has been limited until we hear from you Case ID 210-244-430"

And they had paypal links in the email.

Click to log in and it goes to a paypal clone site at: www.paypal.com.6gffaterjcnj2ju8g3oj.226ip83wfyzb9b.com

Notice they use a subdomain to fool you. You log in, they have your info.

All of these emails can be forwarded to spoof@paypal.com. This was and it is gone.
 
thegreenman said:
Glad you got reimbursed, I can't believe that paypal doesnt have a too many failed attempts lockout wired into their login function. That's just sloppy.
Click to expand...

PayPal is sloppy, ugly, cumbersome, unregulated, and (at times) downright filthy to an almost criminal degree.

Just be lucky they didn't lock you out of your own account and freeze the funds at this point. My business has moved to other means of payment processing unless *absolutely* necessary to use PP.

Glad you caught it early and hope it's an isolated incident!!
 
Here's an old school method that fools new school scanners/banks...sadly I k ow this as I was victimized by it a few yers ago.

I wrote checks for things - I know, I know, old school. But for any purchase like an appliance or something big I preferred having a paper trail.

Someone, at some point in the chain of people who handle cancelled checks, got hold of one of mine.

The high tech fraud is "check washing". They paint over your signature with a clear acrylic, then use acetone to wipe off the rest of the ink. Voila - write it to cash. But no - this was low tech. Instead, using my routing number & acct number, they went online and had custom checks ordered with a bogus name, addy & phone #.

They waited until Labor Day weekend, went to OSH & tacked up $3700 worth of crap & wrote a check for it. I saw that they had a fake ID because the name, addy & phone all matched what the OSH person wrote on the little grid they write when they check IDs.

Fortunately I caught it with online banking - checked y balance before a trip & had a major "WTF?!?" moment. At first i just said "i think y'all messed up & put someone's check against my acct" - it was a woman's name with a city i dont live in & a phone # that doesnt match mine. They asked me to hold and sounded panicked while transferring me to security. Sigh.

Of course the bank gave me my $ back with 24 hours, I to my shock and amazement, the bank doesn't check any of that. They drop all the checks into a giant scanner & whoosh! 2 fields - acct & routing #.

Wrong address? No problem
Wrong gender? No problem
Wrong #? No problem

I only ever write business checks now, and only if they don't take cards.

It kills me how low tech this crime was and how effective. Obviously had to be someone who worked for a bank at some point. Agh.

But SL's right - the type of acct doesn't matter. Where there's a will there's a way. There are bad, bad people on the world. Be vigilant because crime does happen. .
 
This must have happened to me too I have a zero balance currently I'm supposed to have moe money than this.... :liar:

Thats the world we live in hey.. everyones trying to screw everyone one way or another it seems.
 
AAAAnd- even after the advent of internet banking, when, in the process of reviewing my monthly statement. (which included B&W scans of the actual checks, by then...) I found a check that had been posted to my account (about $120), but the name, addy, account number, check design... were all not mine.....and clearly mis-posted by a bank teller.



"Sorry for the Typo error..."



it takes time and diligence to watch over banking/savings/investment accounts. Not including deliberate attempts at theft, human error does come about once in a while.

~~~ :runsaroundpullinghairout:
 
Just a note:
low level reformatting and/or "factory restore" will do little if anything to cure a hacking problem.
#1, any good bug will return on first boot.
#2, quite a lot of hacks exist in the "cloud". I.E. it will still be in your gmail, facebook, or cloud storage.
#3, In my experience, the majority of compromizes arrive via the left mouse button. :rolleyes:

Paypal is convienient, but I don't keep a balance over what I am prepared to lose.
 
On a related subject How do Google Wallet and Square stack up vs Paypal. I have business accounts with all three, but they are all rarely used.
 
There are bank regs that pertain to electronic transfers, like paypal, if you are a victim of fraud Paypal must replace your money.

The "not more than I can lose" is irrelevant.....paypal must reimburse you for fraud.
 
armac said:
There are bank regs that pertain to electronic transfers, like paypal, if you are a victim of fraud Paypal must replace your money.

The "not more than I can lose" is irrelevant.....paypal must reimburse you for fraud.
Click to expand...

Are you sure about that (you obviously have quite the experience in this area vs me)? My understanding was that PayPal was, for now, voluntarily adhering to Regulation E requirements, but that there was no official ruling on whether they were subject to them. There have certainly been lawsuits filed fairly recently (this year) indicating otherwise.

Of course, anyone can file a lawsuit.
 
At the banks I worked Reg E cases the institutons have always promptly returned all money, even the first 50 the consumer is responsible for.

Bank regulators also check during examinations that banks conform to Red E.

The banks in your area may not conform, just my personal experience and understanding of banking regs.
 
You must log in or register to reply here.
Back
Top