Per Paypal: Sudden increase in unauthorized credit card use
derryb
Posts: 37,687 ✭✭✭✭✭
Had two $1500+ ebays sales made with unauthorized credit card charges in a five day period. Fortunate to have been able to intercept and recover both USPS shipments from two different buyers going to two different addresses. One of the advantages of slow moving registered mail.
Spoke at length with paypal high value fraud department today and here is the skinny:
Large sudden increase in unauthorized CC purchases.
Begins with hijacking an ebay account (phishing).
Ebay purchase is made with valid PP account and CC associated with hijacked ebay account.
Item gets shipped to the valid PP shipping address, but is redirected either by change of address or bogus package intercept instructions.
PP and ebay, using all IP addresses involved with the fraud turn the results of their investigations over to the FBI's Internet Fraud people.
Additional steps to protect yourself:
Best to use a shipping service that will not deliver packages to an address other than the one on the package.
Closely monitor tracking on high value shipments and immediately contact shipper of unusual movement.
Tighten up your Ebay "buyer requirement" settings to block buyers with low/bad feedback.
Unfortunately all the crook has to do is hijack the ebay account. This gives him access to using the associated PP account and the credit card tied to the PP account to make what appear as valid purchases until the victim becomes aware of the fraudulent CC charge.
No Way Out: Stimulus and Money Printing Are the Only Path Left
Comments
Thx for the heads up, but I never understood how this works.
When I buy something on eBay I have to log into PayPal separately to pay for it. How does someone hijacking my eBay account give them access to my PayPal account?
Now, if someone hijacked my eBay and then used my good name (feedback score) to sell nonexistent stuff after having changed the associated PayPal account to their own, that I could understand.
In regard to this statement:
Could it be that they are hijacking an eBay account, setting up another PP account with a stolen credit card, and then linking that PP account to the eBay acct? Otherwise, I just don't understand how getting access to an eBay acct gets them access to the original PP acct (unless the original owner somehow linked PP to eBay so that no PP log-in is necessary which would be absurdly unwise.)
Thanks for the advice. Do you know which shipping service(s) has this restriction?
Another similar thread today. Could be a result of the upcoming battle between Paypal and Ebay payments for market dominance.
Probably not but we are wise to suspect each of them.
this is all very good to know. if I ever get a buyer on a 1,500 plus purchase and it just doesn't look right, I am going to cancel the transaction
eBay- email: unique email, unique password, unique email password.
PP- different, unique email; unique password, unique email password.
If one account is compromised, it's harder to get the rest
Somebody has a breach! What a pain in the a## for consumers. Peace Roy
BST: endeavor1967, synchr, kliao, Outhaul, Donttellthewife, U1Chicago, ajaan, mCarney1173, SurfinHi, MWallace, Sandman70gt, mustanggt, Pittstate03, Lazybones, Walkerguy21D, coinandcurrency242 , thebigeng, Collectorcoins, JimTyler, USMarine6, Elkevvo, Coll3ctor, Yorkshireman, CUKevin, ranshdow, CoinHunter4, bennybravo, Centsearcher, braddick, Windycity, ZoidMeister, mirabela, JJM, RichURich, Bullsitter, jmski52, LukeMarshall, coinsarefun, MichaelDixon, NickPatton, ProfLiz, Twobitcollector,Jesbroken oih82w8, DCW
Simple. Once you hijack an ebay account you can see the PP account name in in the Ebay account settings. All you have to do is phish an ebay account where the Ebay account password and the paypal account password are the same. Many people use the same password for many things. The phisher only has to keep hijacking accounts until he gets an ebay account that has the same password as the paypal account. There's probably some digital sweatshop in asia sending out thousands of emails a day that are capturing hundreds of ebay login information.
PP specifically told me the hijacked accounts were currently making use of the valid associated paypal accounts and credit cards and were then interrupting and changing the paypal shipping address once the item is in transit.
My two recent incidents involved ebay buyers with little feedback and little account activity over the past year. I imagine these are the easiest to capture in a phishing scam and can probably be used without notice until the credit card bill arrives.
No Way Out: Stimulus and Money Printing Are the Only Path Left
at my bank i put money into a special credit card.this card is only for e-bay purchases.no monthly fees or service charge. i do this transaction the day i win my bids. usually an hour or so before payment.if they steal my credit card, there is no money in it.they lose, i win.
unfortunately they can still use your credit card to steal from me.
No Way Out: Stimulus and Money Printing Are the Only Path Left
Thanks for the heads up, unfortunately this is the 'time' that we live in.
It will change drastically [for the better I think] in a few years.
Successful transactions with : MICHAELDIXON, Manorcourtman, Bochiman, bolivarshagnasty, AUandAG, onlyroosies, chumley, Weiss, jdimmick, BAJJERFAN, gene1978, TJM965, Smittys, GRANDAM, JTHawaii, mainejoe, softparade, derryb, Ricko
Bad transactions with : nobody to date
Keep in mind, it all starts with the innocent idiot who logs into ebay from a fraudulent email link. Like a virus it quickly affects others.
No Way Out: Stimulus and Money Printing Are the Only Path Left
Turn on 2 factor authentication (2FA) on both eBay and PayPal.
ANA 50 year/Life Member (now "Emeritus")
That's just scary.
this is a 'debit card', and you have to be careful to specify decline all purchases over balance ... as some banks will pay the charge and charge you a overdraft fee as well as expect you to cover the negative balance in next couple days
Good information to know, thanks for the heads-up !!!