A PayPal Phish Story

by Dan on December 31, 2009

The convenience of safe online commerce is becoming more complex, but as is usually the case, the more you know about the online threats and the tools to combat them the more you’ll be equipped to protect your financial transactions.

A friend of mine received a frantic call from his wife after noticing a series of daily PayPal transactions totaling over $2200.00. Each transaction amount ranged between $90.00 and $95.00 and had been executed over a two week period. Each transaction was, of course, addressed to a different unknown recipient.

He quickly checked his PayPal account and confirmed that indeed the company had already put a freeze on his account. A call to their bank, however, was not as reassuring.

The bank requested that they had to physically appear at the bank and file an affidavit detailing the complaint. The bank also suggested that they close the account and reopen a new one as an additional measure of security.

Being a good friend, I recommended that he tell them that he was going to move his millions to a Swiss account. As an account holder your PayPal funds are guaranteed by your credit card or bank account. The seller can request a check or just transfer monies to their PayPal or bank account.

Communication with the PayPal representatives were a little more reassuring, but also a little accusatory. Apparently PayPal’s phishing resources had tried to contact my friend via email. Thinking the emails to be phishing attempts, my friend quickly deleted the messages. Eventually, PayPal took matters into their own hands and froze the account. Unfortunately, this wasn’t completed until after $2200.00 had been illegally transferred from his bank account.

PayPal is, of course, investigating the incident. We’re all hoping, of course, that my friend is going to be able to recover all of his lost monies. The concern is that PayPal will somehow try to avoid total responsibility. There shouldn’t be any question as to whether PayPal’s transactions are within the Purchase-to-Pay (P2P) regulations associated with the Truth-in-Lending Act (TILA). It seems clear to us that the security breach was within PayPal’s security zone.

Leave a Comment

Previous post: Small Business Surviving On The Edge

Next post: Security Ignorance Is Not Bliss