My PayPal Account Hacked - Bank Account Drained

[XJ600s]

Hey all,

So I went to Aspen this weekend with my Mom (no internet access) and when I got back to Boulder at 2am yesterday morning, I had 10 emails from PayPal international saying I had sent 10x 10Euro charges to an account with the email address of Skype (skype@paypalpayments.com). Filed dispute claims with PayPal that minute, but those take up to 10 days to process.

Work up this morning, checked my PayPal account along with my bank account, to find out my bank account is completely drained. No money. Nada. Zilch. And it wasn't like that before I went to bed last night.

Does anyone have experience with PayPal's fraud department? As in, am I going to get my money back or am I now officially fucked? I did a free credit check yesterday and no one has stolen my identity, and I still have perfect credit, so I know the scope of things is limited to my PayPal getting hacked and sending loads of money to a fake Skype account. (side note, the emails I got saying I sent money to skype were all in chinese characters, except for the dollar amounts). I tried removing my bank account number from my PayPal account, but since there is a pending transaction, I can't remove it for another 3-5 days. Same goes with my credit card (its the backup funding source for my bank account).

Where do I go from here? I am definitely going to be calling my bank to try and figure this out, but all i can think right now is that i am fucked. Any ideas? Recommendations? Sympathy?

[McVaaahhh]

Fuck, that totally sucks man.

Good luck with the fraud department, although in my experience they only protect transactions involving ebay. With that said, I have no idea what protection they offer for that kind of transaction.

I hope it goes well for you and please let us all know the outcome. I know a ton of people use paypal on here and that is definitely a nightmare situation.

[Toxicgirl]

oh my gosh, Im sooo sorry!

[MetaLord 9]

Damn dude, you got rogered and but good. Ralph (RForscythe) is gonna be probby the most knowledgeable paypal expert on the board, but you need to truck your ass over to the local FBI dept & let them know what's up. They handle fraud cases, internet & other.

We've sent several bogus checks to them that we've received from craigslist scammers.

good luck man!

[ihavealegohead]

Do you use this password for PAYPAL any where else? Ie. on other web sites? I have one password for each bank I do business with, then I have another generic password for everything else that does not need to be secure.

[ihavealegohead]

... and if you continue to use paypal, get a PayPal Security Key. It's a $5 device like the RSA SecurID.

[XJ600s]

Unfortunately I use the same password as several other closely tied sites, but I've used password crackers on it, and even they couldn't crack the password using brute force and sitting for a week.

MetaLord9, I never thought of contacting the FBI, but I guess after all is said and done I'll send them the information.

ihavealegohead, I remember seeing that paypal security key, but never thought it'd be worth it...but now that I have no money to my name, I may have to pick one up...in 2 weeks when I get my next paycheck that is.

[Devaclis]

Local law enforcement or the FBI should be your first call. Get them rolling on this.

THEN contact Paypal and let them know this is being investigated. Do you have a Paypal card tied to your account? If so, Mastercard or Visa will cover your loses. I would change all of your passwords immediately, contact your banks and let them know (they can keep an eye out for suspicious account activity)

If you would like any more infor, shoot me a PM. I will give you the same advice that you will get from law enforcement and your financial institutions.

[ihavealegohead]

Unfortunately I use the same password as several other closely tied sites, but I've used password crackers on it, and even they couldn't crack the password using brute force and sitting for a week.

One method these guys use, is to set up a legit website to get your email and password.

Then see if you have a paypal account and presto. If you have 10,000 email's and passwords, your bound to have a small percentage that use the same password..

[McVaaahhh]

I just changed my paypal password...

[dm_gsxr]

Scan your machine first. It's possible someone has installed a key grabber and just snagged your password when you typed it in.

Carl

[~Barn~]

Holy jesus... This makes me want to cancel my PayPal account!

Good luck man... Seriously.

[dm_gsxr]

One method these guys use, is to set up a legit website to get your email and password.

Then see if you have a paypal account and presto. If you have 10,000 email's and passwords, your bound to have a small percentage that use the same password..

For things like forums (like this one), I have the same password across the board.

For things that have money tied to them, I have random passwords assigned and save them in my Palm in a password program.

Carl

[Devaclis]

Are you running Vista or XP?

Vista has some great tools that prevent or detect rootkits, keyloggers, phishing, and other, elevation style attacks.

[Devaclis]

Hey Carl, can I borrow your Palm for a second? I need to update the firmware on it

[XJ600s]

I use XP. I have scanned my computer countless times (while both connected and disconnected from the internet) for malware, viruses, spyware, everything...using about 10 different programs.

Right now, my only option is to put a stop payment per se on my account using either PayPal as a trigger word, or the amount they deducted. Those charges would then be credited to my account since they won't clear and I'd have my money back, but then I could never use PayPal again with that bank account as it won't let transactions with those trigger words process.

Unfortunately, I have to go to class right now, stupid exams, but I will be back in an hour to figure things out.

[dm_gsxr]

Hey Carl, can I borrow your Palm for a second? I need to update the firmware on it

Nope, sorry

The passwords are also in an encrypted tool so just having the Palm doesn't get you the passwords. It just keeps me from having them (nice DOS attack )

Carl

[Devaclis]

When using Paypal I recommend tying it to an account at a credit union. They tend to be a bit more methodical when it comes to securing their money, in my past experience. I would also setup a password rotation like most companies do per SOX compliance. Make it a habit to change all of your passwords every 90 days at the most. It may be a pain but it is cheaper than the headache you are going through right now.

[dm_gsxr]

Agreed.

I have four levels of passwords:

1. Paypal, e-bay, Amazon, anything that deals with payments: unique passwords changed about yearly. Getting close to that time in fact.

2. E-Mail: several accounts and passwords. Changed once in a while.

3. Forums: 2 or 3 different accounts and passwords based on the subject matter (for instance, I'm dm_gsxr on the bike sites, Freejack on gaming sites, and bofh on computer sites (or co_bofh if bofh is taken)).

4. One off's such as the NY Times or Denver Post: Same account and password.

Carl

[dm_gsxr]

Oh, and my game keys are in the password locker too Unfortunately I missed putting in my Quake 4 key and I can't find the book (which is why I use the fricking password locker).

Carl

[Devaclis]

Metroid keys FTW!!!!

[dm_gsxr]

What pisses me off more is that I have the keys for Half Life 2 but I can't remember my password or account name on Steam. So even though I have everything, I can't play it. That's irritating.

Carl

[ChrisCBX]

Scan your machine first. It's possible someone has installed a key grabber and just snagged your password when you typed it in.

Carl

+1 on this. I was thinking this would be the most likely problem.

[Gainer]

This exact thing happened to me!!!!! My checking account was overdrawn three times. I had charges from Skype and other telecom companys for international calling cards. I caught it pretty quickly though and notified Paypal right away. They refunded all the transactions, but I still had to pay my bank's overdraw fees. I was pissed!!!! It took them a few days to resolve all of them though.