mind tea

My Paypal account got #hacked over the weekend. Someone used it to buy some $5000 in bitcoins from multiple sellers over several hours between April 15-16. I reported it to Paypal as soon as I discovered this on Monday, Apr 16. However, PayPal is not being helpful with this. They closed the “investigation” in favor of the sellers despite many obvious problems and patterns with this case.

I reported this theft to Paypal as soon as I discovered this and raised two tickets in their so-called Resolution Center:

Paypal Case ID PP-I-1594882. Paypal denied these claims. I called Paypal customer service on April 17, and I was assured these investigations will be reopened. But that was an obvious lie from the Paypal agent I spoke with. See the highlights section below for more details on this shoddy investigation by Paypal.

Paypal Case ID PP-006-822-102-483. This has been decided in my favor, which is contradictory to the previous so-called investigation.

I also reached out to Citi CC customer care, reported the unauthorized transactions (all Paypal transactions from Apr 14 onwards) and blocked my card.

Highlights of the case and Paypal’s incomplete "investigation”

My account password had changed, without my permission, or any notification from Paypal to me. I found this when I tried logging into my account on Apr 16 to learn more about this strange transactions. I had to reset it to log into my account to access it again. In fact, I had to do this twice for some reason.

I removed my CC immediately from Paypal. Strangely, while I wrote the report for Paypal on these transactions, I saw my CC was added again to the account. It is evident, Paypal doesn’t seem to have a very robust system to manage account abuse.

All the transactions for buying bitcoins from different bitcoin sellers, within very short time-frame. I have never used my CC for this, or any other account for that. FACT: I don’t own any bitcoin or any other cryptocurrency! I don’t even have a blockchain key. It is quite obvious that Paypal didn’t even try and contact these sellers to find out who they sold their bitcoins to. This information is easily tracked and if these sellers are not hiding anything, they would have no problems sharing this information.

Paypal didn’t share the IP address used to make these fraudulent transactions either, when they “closed” their investigation. Paypal never bothered to contact me and offer or ask more information on their so-called investigation.

Interestingly, one of the bitcoin sellers in Taiwan ([email protected]), reached out to me. Paypal was initially holding the money to him. He started with complaining about that. As he realized I was hacked he decided to help me and started tracking down the so-called buyer. He has shared a series of mails with me with details of the person who has bought bitcoins from him using my stolen Paypal account.

Paypal has the worst security protection for its users. They do not offer 2-factor authentication for users. This would have prevented my account being compromised. They don’t respect India’s laws for requiring one-time-password to be generated for any credit card use, or any alternative to this to prevent misuse.

😡

I would love to share this with Paypal, but their “Resolution Center” doesn’t allow for any comments to be added to claim tickets. I can;t even create another dispute ticket in the Resolution Center any more. WTF!