Paypal account keeps getting hacked even with 2 step verification: BEWARE

[MikiCab]

Hello Everyone.
For the past week my Paypal account has been getting hacked into every night when I am sleeping even though I have 2 step verification. I have strong password that have have changed every day since this started and am suppose to get a text message when I log in which I do when I log it but I don't when I get hacked. I do not know what is going on with Paypal but they are not secure. As a precaution I am busily changing all my passwords and put a freeze at all three credit rating agencies. I have been on the phone with PayPal every day and they do not seem to be able to stop this so I have removed all links to my financials. They say I cannot close my account because I have several disputes the need to be resolved first. I have asked them repeatedly to lock my account down and every morning I wake up and my password is changed, a phone number has been added and they have attempted to withdraw money. BEWARE if this happens to you. If you have paypal linked to your bank account a chunk of money will come right out of your bank account and then you have to dispute the charges for who knows how long before you get your money back. Once I get this resolved I am removing PayPal. They do not seem to be able to stop this from happening. I have 2 step verification on my email, and other accounts and nothing else seems to be getting hacked. I don't know how they are doing this repeatedly on Paypal.
Anyone else have this experience?

 

[richiev]

Hello Everyone.
For the past week my Paypal account has been getting hacked into every night when I am sleeping even though I have 2 step verification. I have strong password that have have changed every day since this started and am suppose to get a text message when I log in which I do when I log it but I don't when I get hacked. I do not know what is going on with Paypal but they are not secure. As a precaution I am busily changing all my passwords and put a freeze at all three credit rating agencies. I have been on the phone with PayPal every day and they do not seem to be able to stop this so I have removed all links to my financials. They say I cannot close my account because I have several disputes the need to be resolved first. I have asked them repeatedly to lock my account down and every morning I wake up and my password is changed, a phone number has been added and they have attempted to withdraw money. BEWARE if this happens to you. If you have paypal linked to your bank account a chunk of money will come right out of your bank account and then you have to dispute the charges for who knows how long before you get your money back. Once I get this resolved I am removing PayPal. They do not seem to be able to stop this from happening. I have 2 step verification on my email, and other accounts and nothing else seems to be getting hacked. I don't know how they are doing this repeatedly on Paypal.
Anyone else have this experience?

A couple suggestions, apologies if these are saying things you already know.

1. If PP has a way to log out all current logins, make sure to do that. Doesn't necessarily happen by default, and your symptoms sound like someone's in your account
2. Check your email settings, particularly that you don't have an unexpected recovery email address added. Almost certainly they aren't hacking into PayPal, they're exploiting some other way to get into your specific account, including getting into something else and then jumping into your PP account. Similarly logout all devices from your email using your email provider settings (in case they're in your email account without you knowing)
3. When using 2fac, are you using 2fac via email, SMS, or other? SMS is generally the default, but the least secure. There's known holes where people can steal SMS messages (true for all sms based 2fac). Ideally you use a separate 2fac device, or an authenticator program that gives you a code, or use the biometric login setup where your phone acts as 2fac requiring your fingerprint
4. Make sure you're using really secure passwords and not using the same password on every site. Ideal is use a secure password storage app. Second best is have a very secure password that you use everywhere, but change in a certain way for each site. Eg add a memorable prefix unique to each site.
5. Make sure your devices themselves aren't hacked. If using Windows run an antivirus scan.

Sympathies, that must be frustrating. Main summary of all that is be mad at PayPal, and also assume they might be getting in through something else you can control and fix, just so you cover all bases

 

[BAYMAC]

A couple suggestions, apologies if these are saying things you already know.

1. If PP has a way to log out all current logins, make sure to do that. Doesn't necessarily happen by default, and your symptoms sound like someone's in your account
2. Check your email settings, particularly that you don't have an unexpected recovery email address added. Almost certainly they aren't hacking into PayPal, they're exploiting some other way to get into your specific account, including getting into something else and then jumping into your PP account. Similarly logout all devices from your email using your email provider settings (in case they're in your email account without you knowing)
3. When using 2fac, are you using 2fac via email, SMS, or other? SMS is generally the default, but the least secure. There's known holes where people can steal SMS messages (true for all sms based 2fac). Ideally you use a separate 2fac device, or an authenticator program that gives you a code, or use the biometric login setup where your phone acts as 2fac requiring your fingerprint
4. Make sure you're using really secure passwords and not using the same password on every site. Ideal is use a secure password storage app. Second best is have a very secure password that you use everywhere, but change in a certain way for each site. Eg add a memorable prefix unique to each site.
5. Make sure your devices themselves aren't hacked. If using Windows run an antivirus scan.

Sympathies, that must be frustrating. Main summary of all that is be mad at PayPal, and also assume they might be getting in through something else you can control and fix, just so you cover all bases

Oh wow, #1

 

[L/B Block]

I have also had issues with PP since yesterday where I received a security code via text. Unless someone is spoofing my phone not sure where it gets them.

So far no activity but I think I will cut my other financial links for now.

 

[MikiCab]

I have also had issues with PP since yesterday where I received a security code via text. Unless someone is spoofing my phone not sure where it gets them.

So far no activity but I think I will cut my other financial links for now.

This is exactly what happened to me and then they started transferring money to a Cash App account. They were able to log into my account very day even though I changed all my log in information and have two step verification and contacted PP every day letting them know what was going on and them assuring me they were taking steps to prevent it. Every night they were able to get back into my account and add a phone number and try to transfer money. I removed all my banking information today. Don't know how they are doing it and paypal has been unable to stop it. When I log in it get a text message with the 2 part verification. When the hacker logs in I get nothing.

 

[MikiCab]

A couple suggestions, apologies if these are saying things you already know.

1. If PP has a way to log out all current logins, make sure to do that. Doesn't necessarily happen by default, and your symptoms sound like someone's in your account
2. Check your email settings, particularly that you don't have an unexpected recovery email address added. Almost certainly they aren't hacking into PayPal, they're exploiting some other way to get into your specific account, including getting into something else and then jumping into your PP account. Similarly logout all devices from your email using your email provider settings (in case they're in your email account without you knowing)
3. When using 2fac, are you using 2fac via email, SMS, or other? SMS is generally the default, but the least secure. There's known holes where people can steal SMS messages (true for all sms based 2fac). Ideally you use a separate 2fac device, or an authenticator program that gives you a code, or use the biometric login setup where your phone acts as 2fac requiring your fingerprint
4. Make sure you're using really secure passwords and not using the same password on every site. Ideal is use a secure password storage app. Second best is have a very secure password that you use everywhere, but change in a certain way for each site. Eg add a memorable prefix unique to each site.
5. Make sure your devices themselves aren't hacked. If using Windows run an antivirus scan.

Sympathies, that must be frustrating. Main summary of all that is be mad at PayPal, and also assume they might be getting in through something else you can control and fix, just so you cover all bases

I am going through everything to prevent this from continuing. I just thought I would put it up as a cautionary tale since I pay for BAY with paypal.

 

[L/B Block]

I am going through everything to prevent this from continuing. I just thought I would put it up as a cautionary tale since I pay for BAY with paypal.

It’s worth putting out that PSA. I still have my cc connected only that if they do something it’s protected but still monitoring it.

If PP can’t delete your acct can they from an admin point of view freeze all activity. Means you can’t do anything either but at least nobody else can either.

Such a PIA. Hope it gets resolved soon.

 

[MikiCab]

It’s worth putting out that PSA. I still have my cc connected only that if they do something it’s protected but still monitoring it.

If PP can’t delete your acct can they from an admin point of view freeze all activity. Means you can’t do anything either but at least nobody else can either.

Such a PIA. Hope it gets resolved soon.

No. That is the mind boggling part. PP says they cannot freeze my account and I cannot delete it until they resolve the charge backs for the theft. They said the best they can do it to put a note on my account and for me to remove all banking information so no more money can be taken. Every day I locked my account and every night it was hacked into and unlocked and they would try to transfer money to Cash App

 

[L/B Block]

That is poor security. They should be able to freeze all activity.

My other concern is that even after removing all my personal financial data they have all these credit applications for debit/cc that they can tap in to.

Can they move any money now that you have removed all financial institutions?

 

[yoyohead]

PayPal has the ability to 'stay' logged in on some sites which by passes the normal 2-step verification...it sounds like the hackers may have used this same mechanism to access your account ?

 

[MikiCab]

That is poor security. They should be able to freeze all activity.

My other concern is that even after removing all my personal financial data they have all these credit applications for debit/cc that they can tap in to.

Can they move any money now that you have removed all financial institutions?

Now that it is not linked to anything they cannot get any money. Now if they log on the will not be able to get anything but who knows. They seem to be very resourceful.

 

[MikiCab]

PayPal has the ability to 'stay' logged in on some sites which by passes the normal 2-step verification...it sounds like the hackers may have used this same mechanism to access your account ?

I have been talking to PP fraud department since the 24th. They are aware my account is being hacked into every day. They should know how these guys are getting in and how to stop it. They flat out told me they are not able to prevent my account from being hacked and to remove external accounts so they cannot get any money. That was PP fraud departments solution to my problem. They said until the resolve the charge backs I cannot even close the account. If anyone should know how to stop this you would think it would be PayPal.
Here is a useful link I found when researching Identity theft. Phone number to get a hold of live people at Transunion, Experian, Equafax.

How To Reach a Human at Experian, TransUnion or Equifax

Tired of talking to robots? Here's how to reach a real live person at the three major credit bureaus: Experian, TransUnion and Equifax.

clark.com

 

[yoyohead]

I have also had issues with PP since yesterday where I received a security code via text. Unless someone is spoofing my phone not sure where it gets them.

So far no activity but I think I will cut my other financial links for now.

Hmmmm.....does this mean they know your password, which started step-2, sending the security code to your phone ?

 

[MikiCab]

Hmmmm.....does this mean they know your password, which started step-2, sending the security code to your phone ?

I have changed my password every day and I use a password generator to make it tough. They changed the password within an hour while I was on the phone with PayPal fraud department right after I changed it!!!!! I don't know what they are doing but I have been changing all my passwords on everything since the 24th and PayPal seems like the only thing that is being hacked multiple times per day. If a website has it I have 2 step verification. I have no duplicate passwords and my email history shows no signs of being access from any other location than where I live. PayPal has some kind of vulnerability and they cannot plug. Right now I got credit freezes on all 3 credit agencies just in case. If they have enough info to get into my PayPal account they have enough info to do other stuff.