PayPal Scam over Festive Period

[Mike]

Beware Paypal Fraudsters - Folks, a friend's son has been scammed over Christmas. Selling something on eBay, the purchaser suggested a payment using friends and family to save fees.

 

He provided his email address and whilst waiting for payment, received an email "from PayPal" (purportedly), asking him to click here and confirm receipt of funds, which brought up the PayPal login screen, which he logged into.

 

Needless to say no funds materialised, but the link captured his password and then fraudsters took control of his PayPal account, immediately changing his email and password.

 

This all happened on Christmas Eve, over the last 2 days £000s of have been spent on his Paypal account, taking him massively overdrawn at his bank.

PayPal are closed for the festive period and whilst the bank has put a stop on his card, there is an agreement between the banks and PayPal, that banks honour all legitimate requests from PayPal to his account, as there isn't a check between PayPal and the fact that his account is now massively overdrawn. Until PayPal are back online, there is nothing he can do to stop these fraudsters - very clever.

 

Please be very careful when selling via PayPal F&F. PayPal will never ask you to log in to receive funds. Check the email address field from PayPal or indeed any financial services company to ensure it is really from them and NEVER input passwords from a link on an email

 

Keep safe coinsters

[goldhunter]

Sorry to hear about your son's friend being scammed.

Nowadays whenever I transfer money from my bank they send a passcode that I have to input before money is transferred.

Paypal should also use this facility, it would reduce fraud massively.

 

[Chorlton]

Very sorry to hear that, there is a lot of this going round at the moment in various forms.

[Tn21]

Thanks for sharing, hope the kid gets his £ back.

Pls keep us updated 

[Silverman2U]

Sorry to hear. Thanks for the heads up
 

 

[ZigZag]

There seems a few PayPal scams around right now, I bought something fairly innocuous in a iPhone charger the other day on eBay, I’m unsure whether it was a coincidence or not but only minutes after, I got a message on my phone saying my PayPal account had insufficient funds and risked being closed and to click a hyperlink to PayPal.

Which instantly smelt b.s so I just deleted it. Legitimate organisations just don’t contact you in this manner, that seems a key message, don’t click links; sat thinking I bet someone unsuspecting would fall for it.

Sharing to say a lot around and also wish your friends son best of luck @Mike

[Goldmiester]

8 hours ago, goldhunter said:

Nowadays whenever I transfer money from my bank they send a passcode that I have to input before money is transferred.

PayPal actually has this. When you attempt to log in they send a code to your mobile phone which you must input to successfully log in. This was optional until recently, where PayPal made it mandatory for all accounts. With this in mind I am not sure how the scammers managed to login to the victims account as they would require the code sent to the victims phone.

[mouldybread]

4 hours ago, Goldmiester said:

PayPal actually has this. When you attempt to log in they send a code to your mobile phone which you must input to successfully log in. This was optional until recently, where PayPal made it mandatory for all accounts. With this in mind I am not sure how the scammers managed to login to the victims account as they would require the code sent to the victims phone.

This is incorrect, I just logged in to paypal without any need codes so it's not mandatory

Hope your mates boy gets it sorted it's a nasty thing to happen

[Mike]

5 hours ago, Goldmiester said:

PayPal actually has this. When you attempt to log in they send a code to your mobile phone which you must input to successfully log in. This was optional until recently, where PayPal made it mandatory for all accounts. With this in mind I am not sure how the scammers managed to login to the victims account as they would require the code sent to the victims phone.

I agree - I am not 100% sure how it happened and I am still trying to find out more.  There is a slight language complication and also not speaking directly to the victim...the parent is more err-hmm senior...and doesn't;t fully understand it themselves, however, I will post an update as I find out more

[dicker]

Definitely worth switching on two factor authentication for PayPal.  
 

As a rule I ignore all emails from PP. I have had some very convincing scam emails in the last year so now have a rule to auto archive all PP emails.  
 

Best

Dicker

[Chorlton]

Forgot to mention I had an EMail stating my eBay account was going to be suspended unless I logged into it and provided a VAT number etc. as my volume of trade meant I was a business, only very low sales for year so obviously nonsense. One thing to bear in mind is if there is nothing in eBay messages tab it is an obvious scam.

[AppleZippoandMetronome]

To begin I really hope it hasn't been presented to PayPal this way by the victim. Really you want and need to seperate the first bit - accepting F&F vs G&S - from the phishing scam. An oversimlification of how it reads at the moment is - "I wanted to defraud you from your fees by accepting an F&F payment but then I got scammed in a phishing scam - pleast help!". You don't want to give them any room to not look into this and sort it out for you and going in like this versus going in just saying you've been the victim of a phishing scam gives them that opportunity. Focus on the phishing scam - leave out the unnecessary details at the beginning. This is potentially something the fraudsters are aware of. I imagine if they can create a situation where there is ambiguity because the victim deliberately did something wrong they have much more of a chance of PayPal or any financial instirution not bothering with it letting the fraudsters get away with it.

This person would also do well to speak to their bank. As it is a phishing scam the bank might be able to get involved if PayPal won't or if PayPal is slow to respond. These scams have been around for a very long time now so its something all financial instutions will be used to dealing with.

Apart from that...  this person REALLY needs to educate themselves before attepting to complete any more transactions online. Again phishing scams are not at all new and there are always tells in the emails which are quite obvious.

[AppleZippoandMetronome]

9 hours ago, Goldmiester said:

PayPal actually has this. When you attempt to log in they send a code to your mobile phone which you must input to successfully log in. This was optional until recently, where PayPal made it mandatory for all accounts. With this in mind I am not sure how the scammers managed to login to the victims account as they would require the code sent to the victims phone.

This is optional. It needs to be enabled in account settings. 2FA is worth enabling anywhere it exists and it should exist for any website/service that handles money as well as personal information

[sovereignsteve]

10 minutes ago, AppleZippoandMetronome said:

This is optional. It needs to be enabled in account settings. 2FA is worth enabling anywhere it exists and it should exist for any website/service that handles money as well as personal information

I have found this haphazard. I have not set this up nor is it in my account settings. However, recently I have been forced to use 2FA occasionally, mainly when using PP through Ebay, but not always.

This causes me problems as all network mobile signals are appalling where I live.

Also my wife was cursing a few weeks ago when she had to use 2FA out of the blue with her paypal.

[blackadder]

8 hours ago, mouldybread said:

This is incorrect, I just logged in to paypal without any need codes so it's not mandatory

Hope your mates boy gets it sorted it's a nasty thing to happen

Yeah you have to set it up,I finally did it the other day.

[Goldmiester]

On 27/12/2020 at 06:54, mouldybread said:

This is incorrect, I just logged in to paypal without any need codes so it's not mandatory

Hope your mates boy gets it sorted it's a nasty thing to happen

Interesting, I stand corrected. I was sure they made it mandatory. They really should to avoid cases like OP's.

[Groundup]

If anyone is using a Google Two Factor Authentication app for their various accounts. It would be wise to note down the account key codes ( long string of digits) when setting up each account. If your phone crashes or lost or stolen or factory reset then they can't be recovered and it's a headache or time consuming to reset each account. There are apps like "Authy" that make it easier than Google Authenticator. But I like Google.

 

 

 

[cliveb13]

I hope this is sorted but further up the thread someone indicated the trade was going outside PayPal T&C & you will need to clear how this worked & the victims intention 

I share all these fraud stories with my family members ( & friends ) who are not tech savvy. I had a pretty convincing text from ‘DPD’ looking for a delivery fee. Easy to press ok & enter details at this time of year. Scam. But some will go ahead & regret later. 
 

I hope you get sorted 

CB 

 

 

[Mike]

Thank you everyone for your comments - PayPal were advised of the fraud on Tuesday and yesterday they confirmed that these were fraudulent transactions and have refunded all monies to his bank account

[Bullionaire]

2 hours ago, Mike said:

Thank you everyone for your comments - PayPal were advised of the fraud on Tuesday and yesterday they confirmed that these were fraudulent transactions and have refunded all monies to his bank account

Glad he got his money back. Must have been a worrying lesson for him. Its a shame, but you have to be mistrusting of everything these days.