Pay pal website hacked

[bastonjock]

This was in the UK , im posting it here in the hope that others do not get caught out 

I thought I was making a purchase through paypal , I had agreed to purchase a small rv and the guy sent me a link to pay pal , I don't trust embedded links , so I went on to pay pals website and clicked a link to what I thought was their online chat people , the online chat person confirmed the bank account details and I transferred the money , well the stuff did not arrive and im down a large chunk of money

I had used that link about 4 days previously , so the person must have hacked the website for a over a week , I had not contacted the seller by email and I had chatted over a small issue that I thought got resolved , then I saw the rv , I made the payment and , well ive just been told that its a scam

if pay pal cannot police their own website FFS , what hope is there

and yes its a lot of money

Edited July 31, 2019 by bastonjock

[robert k]

1 minute ago, bastonjock said:

This was in the UK , im posting it here in the hope that others do not get caught out 

I thought I was making a purchase through paypal , I had agreed to purchase a small rv and the guy sent me a link to pay pal , I don't trust embedded links , so I went on to pay pals website and clicked a link to what I thought was their online chat people , the online chat person confirmed the bank account details and I transferred the money , well the stuff did not arrive and im down a large chunk of money

I had used that link about 4 days previously , so the person must have hacked the website for a over a week , I had not contacted the seller by email and I had chatted over a small issue that I thought got resolved , then I saw the rv , I made the payment and , well ive just been told that its a scam

if pay pal cannot police their own website FFS , what hope is there

I cut ties with paypal several years ago. Heard nothing but bad things about them since. Both senders and receivers.

[Gary D]

So if it wasn't the paypal website how could you make the payment.

[bastonjock]

1 hour ago, Gary D said:

So if it wasn't the paypal website how could you make the payment.

To put it into clearer perspective,  I had contacted the pay pal website about 4 days earlier regarding a transaction that i had posted to a buyer , i used the Afore mentioned link to chat to what i thought was their representative, the person on the webchat,  I  sure was the scammer , I saw the motorhome a few days ,later and made contact,  we arranged to have it delivered and I was sent a link to pay the seller . I went directly to pay pals web site and clicked on the aforementioned link , I got through to what I thought was a genuine pay pal employee,  I asked about paying the Ebay link and could he check it , he came back with a bank account ,sort code etc and number and told me that it was a holding account , money would be held until I gave the  all clear .

The scammer had hacked the secure front page of pay pals website and he was on there for at least a week and a half , I sont know how many people got duped , but i imagine I'm not alone 

The scammer or scammers must have had access to Ebay's system 

[Mike J]

Found this article as regarding Paypal hack and in relation to Ebay.

https://smallbiztrends.com/2014/08/can-paypal-account-be-hacked.html

Can your PayPal account be hacked? You may think your PayPal account is secure, but think again.
Even if you’ve signed up for PayPal’s Security Key feature, you still need to ponder the safety of your account.

An Australian researcher — just 17 years old — says it’s easy, for a hacker at least, to get around PayPal’s two-step (or two-factor) authentication precautions. Security Key is PayPal’s add-on that sends you a text message to your phone with a second security key needed to access your account.

In the security section of the official PayPal website, the company explains:

“The PayPal Security Key gives you a second authentication factor when you’re logging in to your account. In addition to your password, you enter a One Time Pin (OTP) that is unique for each login. These two factors give you stronger account security.”

But that’s not so as Joshua Rogers tells PC Magazine. The problem with PayPal’s Security Key feature is connected to eBay. And a hacker only needs a user’s eBay and PayPal login credentials to access the account holding the money. If you authorize eBay to immediately withdraw its fees from your PayPal account when a sale is complete, your PayPal account could be vulnerable.

On his blog, Rogers describes:

“When setting this up, you’re (obviously) asked for your PayPal login. Once you’re actually logged in, a cookie is set with your details, and you’re redirected to a page to confirm the details of the process. And this is where the exploit lays. Now just load http://www.paypal.com/ , and you are logged in, and don’t need to re-enter your login.”

PC Magazine notes that another loophole in this feature occurs when a person who has enabled Security Key doesn’t have a phone. If they can’t receive a text message with that second code, they can opt to answer two security questions. The magazine suggests that sort of information is readily available to hackers, too.

By going public with the flaw in PayPal’s security system, Rogers will miss out on any compensation for his discovery. PayPal actually offers a Bounty Program for researchers who alert the company to security flaws. Rogers tells PC Magazine that he told PayPal of his work in early June but nothing became of his alerts.

[sonjack2847]

Paypal took me to court over an unpaid bill. After many phone calls to them with them agreeing the outstanding bill was not mine they still did nothing about it. Out of desperation I called the debt collectors who were threatening me 4 or 5 times I eventually got hold of a woman with common sense who asked me are these the last 4 digits on your card, I replied no and she sorted it there and then. I have never since or will I in the future use paypal.

[Old55]

I'm very sorry to hear you were robbed by those scammers. Long shot but is there any way you could hold PayPal liable for some or all your loss?

[Jollygoodfellow]

8 hours ago, bastonjock said:

i used the Afore mentioned link to chat to what i thought was their representative, the person on the webchat,

I think you were not on a real paypal site as I am sure there is no live chat. Did you check the URL of the site? before giving info for your account? 

[bastonjock]

5 hours ago, Old55 said:

I'm very sorry to hear you were robbed by those scammers. Long shot but is there any way you could hold PayPal liable for some or all your loss?

I am trying  but i dont hold out much hope

[bastonjock]

Heres a screenshot of my conversation with the scammer 

How does a scammer manage to stay on a secure web site for at least 1.5 weeks

He even had a bank account at hsbc that came up on the transfer as pay pal