Online payment giant PayPal warned users yesterday that scam artists have obtained select customer aliases, mailing addresses, e-mail addresses and transaction data by using phony e-mails to fool retailers into revealing the information.
The company said it appeared no personal financial information had been disclosed. But officials said they worried that the fraudulently obtained data could be used to deceive consumers into turning over credit card numbers and other sensitive information.
PayPal is a widely used online payment service that allows Web users to transfer money to each other electronically. PayPal handles the transaction, and neither side sees the other's financial information. Founded in 1998 in San Jose, the company was bought by Internet auctioneer eBay Inc., a major source of new PayPal accounts, four years later. The company now has 40 million customers.
Amanda Pires, a spokeswoman for PayPal, wouldn't identify which merchants were taken in by the scheme or the number of customers whose information might have been exposed. She characterized the number of companies as a "very, very small percentage" of PayPal's millions of merchants.
The companies were apparently sent legitimate-looking e-mails claiming to be from PayPal that asked for password and other account information. The passwords gave the fraudsters access to customer rosters and other sales data, but not to actual credit card or bank account numbers, according to PayPal.
That financial information is stored on secure computer servers that cannot be accessed by any merchant or third party, the company said.
Still, with customer names and other personal information, PayPal officials warned that scammers could direct their "phishing" expeditions toward the customers themselves and seek to trick them into revealing financial information.
For example, scam artists have sent phony PayPal e-mails to users advising them their account would be placed on a "restricted status" until they completed a "credit card confirmation process" online at bogus Web sites designed to look like ones belonging to PayPal.
While such schemes are usually sent blindly to millions of e-mail addresses in the hope of fooling a few Internet users, PayPal warned that scammers using the purloined personal information might achieve a higher rate of success by strategically including some of a user's data. For instance, they might refer to a recent purchase.
"These e-mails could be very, very specific and could deceive people," Pires said, adding that PayPal has not yet seen evidence of fraudulent e-mails resulting from the security breach.
Pires said PayPal does not ask for personal financial information via e-mail and does not refer to old transactions through e-mail.
Pires said that the company grew suspicious last week after noticing some unusual activity in the accounts of one of its merchants. When the company found that more than one of its merchants had been duped by the scam, the company decided to warn the public and posted a notice on its Web site Friday afternoon.
Bruce Schneier, a computer security expert, characterized the scam as "really bad news."
"The more data an attacker gets, the more effective they'll be," he said. "This attack bypasses security and attacks the user directly. It's like me convincing you to give me your ATM card and your PIN."
But David Ricci, an analyst at William Blair & Co. -- and a PayPal user -- credited PayPal for spotting the scam and alerting users. "The company is fastidious about its commitment to safety in all respects," he said.
Cori Martinell, a Washington resident who uses PayPal largely to make purchases related to her knitting hobby, took the alert in stride yesterday.
"Maybe I should worry about my privacy, but it doesn't bother me if people want to know about the ridiculous amount of money I spend on yarn," she wrote in an e-mail.
thats why i will never verify my account with ebay. there is no way that i am going to give them my bank account number . thats all i need is someone getting that info. that would be a nightmare.
Comments
The company said it appeared no personal financial information had been disclosed. But officials said they worried that the fraudulently obtained data could be used to deceive consumers into turning over credit card numbers and other sensitive information.
PayPal is a widely used online payment service that allows Web users to transfer money to each other electronically. PayPal handles the transaction, and neither side sees the other's financial information. Founded in 1998 in San Jose, the company was bought by Internet auctioneer eBay Inc., a major source of new PayPal accounts, four years later. The company now has 40 million customers.
Amanda Pires, a spokeswoman for PayPal, wouldn't identify which merchants were taken in by the scheme or the number of customers whose information might have been exposed. She characterized the number of companies as a "very, very small percentage" of PayPal's millions of merchants.
The companies were apparently sent legitimate-looking e-mails claiming to be from PayPal that asked for password and other account information. The passwords gave the fraudsters access to customer rosters and other sales data, but not to actual credit card or bank account numbers, according to PayPal.
That financial information is stored on secure computer servers that cannot be accessed by any merchant or third party, the company said.
Still, with customer names and other personal information, PayPal officials warned that scammers could direct their "phishing" expeditions toward the customers themselves and seek to trick them into revealing financial information.
For example, scam artists have sent phony PayPal e-mails to users advising them their account would be placed on a "restricted status" until they completed a "credit card confirmation process" online at bogus Web sites designed to look like ones belonging to PayPal.
While such schemes are usually sent blindly to millions of e-mail addresses in the hope of fooling a few Internet users, PayPal warned that scammers using the purloined personal information might achieve a higher rate of success by strategically including some of a user's data. For instance, they might refer to a recent purchase.
"These e-mails could be very, very specific and could deceive people," Pires said, adding that PayPal has not yet seen evidence of fraudulent e-mails resulting from the security breach.
Pires said PayPal does not ask for personal financial information via e-mail and does not refer to old transactions through e-mail.
Pires said that the company grew suspicious last week after noticing some unusual activity in the accounts of one of its merchants. When the company found that more than one of its merchants had been duped by the scam, the company decided to warn the public and posted a notice on its Web site Friday afternoon.
Bruce Schneier, a computer security expert, characterized the scam as "really bad news."
"The more data an attacker gets, the more effective they'll be," he said. "This attack bypasses security and attacks the user directly. It's like me convincing you to give me your ATM card and your PIN."
But David Ricci, an analyst at William Blair & Co. -- and a PayPal user -- credited PayPal for spotting the scam and alerting users. "The company is fastidious about its commitment to safety in all respects," he said.
Cori Martinell, a Washington resident who uses PayPal largely to make purchases related to her knitting hobby, took the alert in stride yesterday.
"Maybe I should worry about my privacy, but it doesn't bother me if people want to know about the ridiculous amount of money I spend on yarn," she wrote in an e-mail.
thats why i will never verify my account with ebay. there is no way that i am going to give them my bank account number . thats all i need is someone getting that info. that would be a nightmare.
john