So my Paypal account was hacked at exactly 10:01am this morning. In the many years that I have been doing online transactions, I’ve gotten used to frauds and hacks but this one from Paypal (Unauthorized Transaction) is the biggest so far.
Just woken up before 10am this morning and was checking the blog when I received an email alert from Paypal (thanks to the GMail pop-up alert plugin). The heading says something like “Password Reset” so I immediately logged into my email and check what it was.
Realizing that someone tried to submit a “Forgot Password” request, I went to Paypal and logged in. After 2 failed attempts, I concluded someone got in and changed my password. But how? First came to mind was one of the email accounts attached to my Paypal account was hacked and used to reset the password.
Knowing that my GMail is still working (and is my primary Paypal account), I hurriedly went and did another password reset. Good thing I had my bank account details ready.
After being able to log back again, I found that funds were transferred to another account (that was fast! it only took him minutes). Unfortunately, it was a sizable amount.
The first thing I did was remove all the other email accounts linked to Paypal so the hacker can’t request another password change. I also changed my passwords and details.
I then filed for Dispute with Paypal. I thought this would be easy and will be resolved in my favor. Besides, I am the one claiming the transaction was un-authorized — the burden is on the recipient to prove otherwise. I had confidence it will be alright and done with.
Around 30 to 45 minutes later, I received an email from Paypal stating the transaction is valid. What? The recipient had a Non-US, Un-verified account. Paypal did not give any details why they decided against the claimant (me) and approved the transaction and closed the dispute.
There was no other way to re-open the case so I tried calling Paypal US but the Web PIN they gave me doesn’t work and I could not get thru.
Still thinking of ways to re-open that dispute. Will update once I get things cleared.
Update: Hacker got back again using password reset. They also changed my primary email so I am locked out now (it looks like they added a new email, onlinebuys@yahoo.com, and then made it primary email then deleted my email accounts). Already send an email to PayPal support, DMed @AskPaypal and tried calling the US number many times to no avail.
Update 2: I believe it was my fault that I did not immediately changed my GMail account. It was the one that was compromised although the password on the email was not changed the first time around that’s why I did not suspect the initial breach to come from there. I have since added the 2-step authentication method which also requires a PIN sent thru my mobile phone via SMS.
I also called my credit card company and asked if there were any charges passed on thru Paypal and glad that there have been none. I alerted them of the possibility though and they suggested I monitor it from time to time.
Update 3: After a few exchanges with @askpaypal over Twitter, a Paypal US rep called me last night over the phone and helped me restore my account. I have since gained back my original Paypal account. The 2 fund transfers made are also now under investigation.
Update 4: I just got an email stating that my claim for un-authorized transfer has been denied due to lack of evidence. I thought that after establishing that my account was hacked, it would have been evidence enough. I’m making an appeal.
Update 5: Both of the un-authorized transfers have now been reversed and everything is back to normal. Thanks to Paypal for the quick response and to all those who extended the help (local PR, agency, fellow tweeps and especially @askpaypal). That’s 32 hours from incident to resolution.
it could have been the chinese! lol
Hi,
Good day. I work for Prepaid Debit Mastercards and Visas here in Baguio City (our main office is in California) and I strongly agree that there are a lot of unauthorized transactions done through PayPal and I also agree that PP works on “disputes”, contrary to what was mentioned earlier. We also have our own dispute process, and if in cases like the transaction dispute was “not granted” by PP, our company will file a dispute for the cardholder to get his/her money back in the account (e.g through chargeback, courtesy credits and the like).
Thanks for this info sir Yuga. . This is the reason why the credit card that I attached to my Paypal has the minimum credit limit. I did not attach my other CC with a huge credit limit. I hope all will be resolve in your case. Good Luck.
Twitter: harleymahson
says:
changed my password for all my accounts especially paypal! made it stronger, deleted some other credit cards attached and stuff like that! whew!
sana sir yuga maibabalik yan!
Baka iniisip ni Paypal na you hacked your own account then disputed it.
For example you have Php30,000 balance in your paypal then you hacked it then transfered to different Paypal you own and widraw or spend the money. Then file a dispute for unauthorized fund transfer. Dahil pag check ni Paypal na wala ng balance ang hacker paypal account hindi talaga nya ibabalik Php30,000 mo kasi malulugi sila.
If example you hack your own paypal account. Your Php30,000 will become Php60,000 if paypal return your funds.
Its very easy to create and verify paypal account nowadays. You can verify your Paypal using VCC or Virtual Credit Card.
Hindi ko sinasabi na Sir Yuga hacked his own Paypal Account. I’m just giving a scenario.
You withdraw or spend the Php30,000 you hacked in your own Paypal. Then Paypal return your Php30,000 funds after you file a dispute for un-authorized fund transfer.
Easy money. Magandang pagkakitaan yan kung ganun kadali magbalik ng funds si Paypal.
Scenario:
PayPal Account 1: Balance Php30,000
PayPal Account 2: Balance Php0.00
Ask your kasabwat from different country or places to log-in in your Paypal account 1 and Transfer the balance to PayPal Account 2 then change the password and e-mail of PayPal Account 2 para magmukhang na hacked nga.
Then you asked your kasabwat to Withdraw or Spend the PayPal Account 2.
After the PayPal Account 2 was emptied. Then you email or call PayPal that your account is hacked and you want your Php30,000 balance back.
PayPal check the PayPal Account 2, they found out that it was Php0.00 balance already because your kasabwat spend it already.
PayPal will reply you back that they will not favor you to return your Php30,000. Kasi naman bakit sila magbabalik ng Php30,000 galing sa bulsa nila.
If ganun kadali si PayPal mag returns ng funds. Then its an easy money.
Of course you cannot hacked your PayPal Account using same IP address and same computer because PayPal will find it out. Kaya dapat may kasabwat ka from other country or area.
Twitter: PaulitoX
says:
@Abe congratulations. Pinahanga mo kami sa calm resolve mo. Even if you failed several times you kept your cool.
Pero thanks for the heads up. I thought this only happens to file server accounts LOL.
Twitter: marjunegarcia
says:
still this is scarry.. i think they consider your appeal coz they find out that your a famous blogger and it will have greater impact on users here and abroad.. so for all paypal user.. dont let a big amount of money to your paypal account.. always withdraw your money and left a little.. just a precautionary measure..
Twitter: deuts
says:
Great that resolved ultimately. But you are a big influence in the Phil. Tech industry. What if the same thing happens to us lowly souls?
@Jun yeah that’s what I think too, but I hope that’s not the case.
Congrats for getting your account and funds back.
Twitter: momblogger
says:
so relieved you got your account and money back. I even tweeted @askpaypal to make sure they worked on it.
This happened to me last May 10. I was surprised when I saw 4 payments that were made which I didn’t authorize. The amount involved is very big and I immediately called PayPal to report. Here are some emails that I found during the hacking incident.
yahseen1342@yahoo.com
onlinebuys@yahoo.com
net.programer@yahoo.com
fuzelme@yahoo.com
moneymaking78@yahoo.com
Here’s a tip. If you’re linking your bank account in your PayPal account. Make sure you’re the only one who knows the full account number. This is maybe how Yuga got hacked because your account numbers are visible on your website.
Twitter: phsolidhosting
says:
It’s good thing they have @AskPayPal! Mas mabilis ang response compared to filing a dispute sa account mo.
Probably Paypal realizes that they are messing with the wrong guy! the biggest tech blogger in the Philippines
Twitter: phsolidhosting
says:
Here’s a blog regarding this hacker.
http://victimsofervinabellanosa.blogspot.com/
The gay is from Cebu!
Twitter: jesehl
says:
tama. eto nga yung gumawa nito. I am quite sure kasi I was scammed by him recently. If na scam din kayo, pwede tayo magtulungan para mahuli itong baklang ito. Ervin Abellanosa name. Text me if want niyo makipagtulungan para mahuli ito.. 0905-3277166
Sir Abe, after the dust settles down on this and after you find out how exactly the hacker got your account, maybe you could provide us some tips on how we can really secure our online accounts.
For starters, I’m already done with the 2 step verification with Google, any thing else we should look into?
thanks in advance
shouldnt you report this to the authorities? or nbi?
i think someone watching you here….ive checked your contact details. is your email and paypal account is the same?
[...] posted here: Disputing Unauthorized Transactions on Paypal This entry was posted in Uncategorized and tagged before-10am, biggest, doing-online, morning, [...]
Twitter: mydiscovery
says:
So I changed my password now in Paypal and checked other security settings. I think Paypal should add more security feature when sending funds. Like in EON, a transaction password which is different from the password should be entered before a transfer pass thru.
Glad to know that it has been resolved.
Twitter: jesehl
says:
tama. . I am quite sure na si Ervin Abellanosa and gumawa niyo kasi I was scammed by him recently. If na scam din kayo, pwede tayo magtulungan para mahuli itong baklang ito. Ervin Abellanosa name. Text me if want niyo makipagtulungan para mahuli ito.. 0905-3277166
I also got hacked two days ago. Someone used my paypal account to subscribe to a monthly service. Its $59 a month. I am not usually checking my paypal but good thing I had to check yesterday to transfer money to my bank and I found out the subscription I am paying which I didn’t know. Right away I sent a dispute to paypal and also emailed the company where I said I was subscribing. I cancelled my subscription right away and still waiting If I could get a refund.
[...] my Paypal account got closed down Tweet Barely over a month since my Paypal account was hacked and restored, I once again encountered a disastrous incident — this time, Paypal emailed me [...]
[...] PayPal — a.k.a. the most popular payment option for freelancers. The clincher for many consumers and freelancers is the security that PayPal affords; PayPal users don’t have to divulge their entire credit card and bank account details to send and receive money. However, a lot of freelancers and entrepreneurs have encountered problems with PayPal, particularly with account ownership and control disputes — the most recent one involved popular tech blogger Abe Olandres (a.k.a. Yuga); see what he has to say here and here. [...]
Twitter: redgedimaano
says:
How can I dispute? I am having the same problem like you now Sir Yuga. My paypal account was hacked too. Just now. I need help please.