# How the \[expletive\] did my Paypal account get hacked? **URL:** \ **Category:** Factual Questions\ **Created:** [December 20, 2010, 9:46pm UTC](https://boards.straightdope.com/t/how-the-expletive-did-my-paypal-account-get-hacked/564879 "2010-12-20T21:46:50Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![AnalogSignal](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/analogsignal/32/1085_2.png) [@AnalogSignal](https://boards.straightdope.com/u/AnalogSignal)\ **Post date:** [December 21, 2010, 2:59am UTC](https://boards.straightdope.com/t/how-the-expletive-did-my-paypal-account-get-hacked/564879/21 "2010-12-21T02:59:25Z")
> [@rachelellogram](#): > > Not saving my passwords in firefox is not a concession I’m willing to make My best guess is that malware read your PayPal password from Firefox. I know you did two anti-virus scans but that doesn’t prove your PC is clean. I suggest running Microsoft’s Malicious Software Removal Tool next. Start-\>Run-\>“mrt” It is very slow but pretty thorough. I think you should also consider using LastPass. It is more secure than Firefox’s password manager. ---
**Author:** ![ecseas](https://avatars.discourse-cdn.com/v4/letter/e/35a633/32.png) [@ecseas](https://boards.straightdope.com/u/ecseas)\ **Post date:** [December 21, 2010, 3:00am UTC](https://boards.straightdope.com/t/how-the-expletive-did-my-paypal-account-get-hacked/564879/22 "2010-12-21T03:00:36Z")
Could a virus have slipped pass your anti virus programs? ---
**Author:** ![Rachellelogram](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/rachellelogram/32/8689_2.png) [@Rachellelogram](https://boards.straightdope.com/u/Rachellelogram)\ **Post date:** [December 21, 2010, 3:16am UTC](https://boards.straightdope.com/t/how-the-expletive-did-my-paypal-account-get-hacked/564879/23 "2010-12-21T03:16:02Z")
It’s not an utter impossibility that the scanners missed it, of course. I was hoping that by using two different scanners, it’d be a fairly foolproof measurement of my computer’s cleanliness. > [@AnalogSignal](#): > > My best guess is that malware read your PayPal password from Firefox. I know you did two anti-virus scans but that doesn’t prove your PC is clean. > > I suggest running Microsoft’s Malicious Software Removal Tool next. Start-\>Run-\>“mrt” It is very slow but pretty thorough. > > I think you should also consider using LastPass. It is more secure than Firefox’s password manager. I’ll try the Microsoft tool when I get home and see if it picks anything up. Better safe than sorry, of course. I am a VERY safe browser (due to software and habits), and I frequently check every single running process and my installed programs. If a new process had popped up (like a keylogger), I would have seen and googled it. But it’s not impossible something could have slipped by me. Thank you for the recommendation of LastPass. I’ve never heard of it. I was really fond of Opera’s magic wand back when I used it eons ago. It’s just that Firefox is easier (and has adblocker etc) so I haven’t tried Opera in years. ---
**Author:** ![AnalogSignal](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/analogsignal/32/1085_2.png) [@AnalogSignal](https://boards.straightdope.com/u/AnalogSignal)\ **Post date:** [December 21, 2010, 3:41am UTC](https://boards.straightdope.com/t/how-the-expletive-did-my-paypal-account-get-hacked/564879/24 "2010-12-21T03:41:26Z")
> [@rachelellogram](#): > > I was hoping that by using two different scanners, it’d be a fairly foolproof measurement of my computer’s cleanliness…I frequently check every single running process and my installed programs. Unfortunately, there is no foolproof method for determining if your PC is infected. Rootkits probably will not be visible in Task Manager. > [@rachelellogram](#): > > Thank you for the recommendation of LastPass. I’ve never heard of it. LastPass is great. It will read all of your Firefox passwords automatically and then suggest you delete them from Firefox password manager because it is unsafe. It can do everything Firefox password manager does and more. It also supports multifactor authentication if you want to be super-secure. ---
**Author:** ![Rachellelogram](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/rachellelogram/32/8689_2.png) [@Rachellelogram](https://boards.straightdope.com/u/Rachellelogram)\ **Post date:** [December 21, 2010, 3:59am UTC](https://boards.straightdope.com/t/how-the-expletive-did-my-paypal-account-get-hacked/564879/25 "2010-12-21T03:59:41Z")
I have an authenticator dongle for my WoW account and I personally regard it as among the best $6 I ever spent. Does multifactor authentication have any effect if someone tries to log on from not-my-computer, though? My hardware is definitely not a weak point. I’m more concerned about potential MITM attacks and unless I can force the sites I regularly visit (here, [wowhead.com](http://wowhead.com), Savage Love) to accept a second method of authentication, I don’t see how that would be helpful. ---
**Author:** ![BigT](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bigt/32/12044_2.png) [@BigT](https://boards.straightdope.com/u/BigT)\ **Post date:** [December 21, 2010, 4:18am UTC](https://boards.straightdope.com/t/how-the-expletive-did-my-paypal-account-get-hacked/564879/26 "2010-12-21T04:18:37Z")
For rootkits, I suggest testing with LiveCD scanner. I know [Avira Antivir](http://www.avira.com/en/support-download-avira-antivir-rescue-system) has one. For the non-technical, this means the computer will boot of the CD, and not the possibly infected hard drive. ---
**Author:** ![AnalogSignal](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/analogsignal/32/1085_2.png) [@AnalogSignal](https://boards.straightdope.com/u/AnalogSignal)\ **Post date:** [December 21, 2010, 4:20am UTC](https://boards.straightdope.com/t/how-the-expletive-did-my-paypal-account-get-hacked/564879/27 "2010-12-21T04:20:05Z")
> [@rachelellogram](#): > > Does multifactor authentication have any effect if someone tries to log on from not-my-computer, though? My hardware is definitely not a weak point. I’m more concerned about potential MITM attacks and unless I can force the sites I regularly visit (here, [wowhead.com](http://wowhead.com), Savage Love) to accept a second method of authentication, I don’t see how that would be helpful. Multifactor authentication is an option for your LastPass password. So if your LastPass password is somehow captured, you still can’t be compromised. Once you are logged into LastPass, it takes care of all of the other passwords for you. It cannot force sites to use multifactor authentication. ---
**Author:** ![IAmNotSpartacus](https://avatars.discourse-cdn.com/v4/letter/i/cc9497/32.png) [@IAmNotSpartacus](https://boards.straightdope.com/u/IAmNotSpartacus)\ **Post date:** [December 21, 2010, 4:23am UTC](https://boards.straightdope.com/t/how-the-expletive-did-my-paypal-account-get-hacked/564879/28 "2010-12-21T04:23:43Z")
What is the version of your Firefox? And you may want to consider adding a master password for your FF saved passwords if you haven’t already. ---
**Author:** ![iamnotbatman](https://avatars.discourse-cdn.com/v4/letter/i/858c86/32.png) [@iamnotbatman](https://boards.straightdope.com/u/iamnotbatman)\ **Post date:** [December 21, 2010, 4:49am UTC](https://boards.straightdope.com/t/how-the-expletive-did-my-paypal-account-get-hacked/564879/29 "2010-12-21T04:49:04Z")
> [@rachelellogram](#): > > Then I manually typed the paypal site url into my browser IMO it is safer as a general habit to type ‘paypal’ (or whatever) into your google search bar rather than the url bar. Google will correct any mistakes that would otherwise take you to a phishing operation. Now, here are my own anecdotes: I am not stupid either, but years ago I did once fall for one of the email phishing scams. Absolutely perfect looking email from paypal sent at just the right time so that I was expecting an email from them anyways. I glanced at the url the link pointed to, and it had “[paypal.com](http://paypal.com)” in it and just didn’t look closely enough because I was in a hurry. About 5 minutes later I realized what I had done and canceled my credit card. Are you sure you couldn’t have done something like this and just don’t remember?? Here is another thing that happened to me. I bought something from an online retailer. Not a suspicious retailer, but definitely a smaller operation. About 6 months later my credit card is blocked and there are all these bizarre “colon blow” charges etc. I had no idea how my credit card information could have been stolen. Then, a few months later, I get a letter from the online retailer saying they had a data breach and that everybody’s credit card information was stolen. So that’s that. ---
**Author:** ![Mangetout](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mangetout/32/19_2.png) [@Mangetout](https://boards.straightdope.com/u/Mangetout)\ **Post date:** [December 21, 2010, 8:50am UTC](https://boards.straightdope.com/t/how-the-expletive-did-my-paypal-account-get-hacked/564879/30 "2010-12-21T08:50:34Z")
> [@rachelellogram](#): > > You could have read the OP (which was cogently grammatical) in which I stated that I do not click phishing emails. You could have read further comments to the post in which I stated I was internet-savvy. and > [@](#): > > I’ve talked to people who think they’re really internet-savvy and are not. And we’re here talking to you. Without clarification (that we were trying to obtain by asking you questions you clearly found annoying), how the hell are we supposed to discern whether you are one or the other of these two types of people? A person can say ‘I don’t click phishing emails’ without really understanding what they mean, or all the different ways in which phishing emails may present themselves. There was no way, except by asking, to determine your level of savvy. ---
**Author:** ![mittu](https://avatars.discourse-cdn.com/v4/letter/m/ecd19e/32.png) [@mittu](https://boards.straightdope.com/u/mittu)\ **Post date:** [December 21, 2010, 10:55am UTC](https://boards.straightdope.com/t/how-the-expletive-did-my-paypal-account-get-hacked/564879/31 "2010-12-21T10:55:44Z")
> [@rachelellogram](#): > > I am a VERY safe browser (due to software and habits), and I frequently check every single running process and my installed programs. If a new process had popped up (like a keylogger), I would have seen and googled it. But it’s not impossible something could have slipped by me. It doesn’t help you if the malicious code is injected into a valid Windows process, it will appear just as it always has and curing the files can be a real pain in the backside. Plenty of people who claim to be internet savvy will fall for a phishing scam, assuming that [paypal.billing.com](http://paypal.billing.com) (or similar) is associated with Paypal so please don’t take offense at people checking the obvious before moving on to the more extreme options, occam’s razor and all that. Given that you haven’t used this password on any website except for paypal it is possible that a keylogger is to blame. Run through as many free AV scans as you can find, in particular make sure to try Malwarebytes, SuperAntiSpyware, Microsoft Security Essentials and TDSS Killer. You can never really be 100% sure you are clean of viruses or malware but it will bring you closer. ---
**Author:** ![groo](https://avatars.discourse-cdn.com/v4/letter/g/ecd19e/32.png) [@groo](https://boards.straightdope.com/u/groo)\ **Post date:** [December 21, 2010, 3:43pm UTC](https://boards.straightdope.com/t/how-the-expletive-did-my-paypal-account-get-hacked/564879/32 "2010-12-21T15:43:35Z")
I don’t think you’re fucking stupid, and I can understand your frustration and/or anger. Another attack mechanism is to host some dipshit website that gives some sort of benefit for people who “register,” collect the usernames and passwords, and try to use those usernames and passwords on other sites, since many people use the same password on multiple sites. Is that a possibility? ---
**Author:** ![Ionizer](https://avatars.discourse-cdn.com/v4/letter/i/5daacb/32.png) [@Ionizer](https://boards.straightdope.com/u/Ionizer)\ **Post date:** [December 21, 2010, 4:50pm UTC](https://boards.straightdope.com/t/how-the-expletive-did-my-paypal-account-get-hacked/564879/33 "2010-12-21T16:50:37Z")
I was hit by a Jave exploit that snuck in by way of imitating a Java update not too long ago (few weeks?). At least that is what I _think_ happened. I’ve gotten a few of those auto-updates for Java and the second-to-last one must’ve been fake. More than a week after the update, MS SecEssentials pops up with a big red alert and says I am under attack from a Java exploit ([CVE-2009-3867.GU](https://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Exploit%3AJava%2FCVE-2009-3867)). Nothing happened other than me quarantine/deleting it with two or three clicks…from the Sun/Java/deployment~ directory. I also use Comodo firewall, IOBit360-Pro and weekly MalwareBytes updated every few days. None of those caught it while it sat there waiting - only the activation caused the alert. No idea what the intent/purpose of the code was, but its never any good. Shit can disguise itself pretty good nowadays, ime. I am kinda embarrassed over it as I had to approve the update through Comodo firewall. _Any_ updating now has me going to company website to verify release of said updates, etc… Just saying this as a learning point so maybe others don’t get worse results than I did. I am not highly fluent in ‘defense’ by any means nor highly ignorant - but I am not keeping up with trends if I am letting them in when they knock :smack: ---
**Author:** ![Martiju](https://avatars.discourse-cdn.com/v4/letter/m/e8c25b/32.png) [@Martiju](https://boards.straightdope.com/u/Martiju)\ **Post date:** [December 21, 2010, 5:04pm UTC](https://boards.straightdope.com/t/how-the-expletive-did-my-paypal-account-get-hacked/564879/34 "2010-12-21T17:04:07Z")
Hi **Rachelellogram** I got caught by this last week too - and I’m also not a particularly stupid internet user. I have no idea how this happened, but I suspect a Paypal problem, not least because they caught it straight away and didn’t dispute the issue at all. Mine was to a cable company in the US - similar amount. ---
**Author:** ![RaftPeople](https://avatars.discourse-cdn.com/v4/letter/r/6f9a4e/32.png) [@RaftPeople](https://boards.straightdope.com/u/RaftPeople)\ **Post date:** [December 21, 2010, 8:17pm UTC](https://boards.straightdope.com/t/how-the-expletive-did-my-paypal-account-get-hacked/564879/35 "2010-12-21T20:17:43Z")
PayPal was a target of hacker group Anonymous due to the WikiLeaks thing, your accounts could have been compromised due to that. ---
**Author:** ![Rachellelogram](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/rachellelogram/32/8689_2.png) [@Rachellelogram](https://boards.straightdope.com/u/Rachellelogram)\ **Post date:** [December 21, 2010, 9:17pm UTC](https://boards.straightdope.com/t/how-the-expletive-did-my-paypal-account-get-hacked/564879/36 "2010-12-21T21:17:23Z")
> [@iamnotbatman](#): > > Are you sure you couldn’t have done something like this and just don’t remember?? I’m quite sure. Like I said, I actually called Paypal. The transaction had been done and flagged as fraudulent while I was asleep. I hadn’t looked at or logged into my paypal for months prior to this incident occurring. I’m very careful at checking my email headers on anything that comes from a financial institution before I take it seriously. Ionizer, I did see a weird java pop up thingy about a week ago but I told it not to install (so I don’t think it did… I think). I don’t really ever update java automatically because I use noscript and I avoid flash sites. But that’s a really good point/possibility. Thanks for contributing, Martiju and RaftPeople. A guildmate of mine in WoW had this happen to her through paypal, but it was for itunes songs in the amt of like $300… she got it reversed but yowch ☹ And just for a thread FYI I got another email stating they had decided my case in my favor. Hooray! Now I’m just waiting on the funds to come back into Paypal so I can put them back in my bank. ---
**Author:** ![iamnotbatman](https://avatars.discourse-cdn.com/v4/letter/i/858c86/32.png) [@iamnotbatman](https://boards.straightdope.com/u/iamnotbatman)\ **Post date:** [December 21, 2010, 9:24pm UTC](https://boards.straightdope.com/t/how-the-expletive-did-my-paypal-account-get-hacked/564879/37 "2010-12-21T21:24:15Z")
> [@rachelellogram](#): > > I’m quite sure. Like I said, I actually called Paypal. The transaction had been done and flagged as fraudulent while I was asleep. I hadn’t looked at or logged into my paypal for months prior to this incident occurring. I’m very careful at checking my email headers on anything that comes from a financial institution before I take it seriously. Not to harp on a point, but the fact that you were asleep and had not logged into your account for months is irrelevant to the point I was making. Once a phisher gets your information, it can be months before they used it, and they can use it any time they want. ---
**Author:** ![Rachellelogram](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/rachellelogram/32/8689_2.png) [@Rachellelogram](https://boards.straightdope.com/u/Rachellelogram)\ **Post date:** [December 21, 2010, 10:01pm UTC](https://boards.straightdope.com/t/how-the-expletive-did-my-paypal-account-get-hacked/564879/38 "2010-12-21T22:01:26Z")
I honestly can’t think of the last time paypal sent me anything. Or that a phisher might have sent masquerading as paypal. I haven’t even thought about paypal in ages. But yeah, I guess I can’t 100% discount the possibility. All I can be sure of is that I didn’t click on a fauxpal email recently. People upthread were insinuating that I clicked on a scam email and then the scam immediately took place, and I wanted to be clear that that definitely was not the case. ---
**Author:** ![Mangetout](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mangetout/32/19_2.png) [@Mangetout](https://boards.straightdope.com/u/Mangetout)\ **Post date:** [December 21, 2010, 10:16pm UTC](https://boards.straightdope.com/t/how-the-expletive-did-my-paypal-account-get-hacked/564879/39 "2010-12-21T22:16:29Z")
> [@rachelellogram](#): > > People upthread were insinuating that I clicked on a scam email and then the scam immediately took place, and I wanted to be clear that that definitely was not the case. We were not _insinuating_ (well, I wasn’t) anything - I was trying to get some clarification. I too wanted to be clear that it wasn’t the case, but it wasn’t absolutely clear (to me) until after I asked the questions, and you answered them. ---
**Author:** ![Analogue\_Skywalker](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@Analogue\_Skywalker](https://boards.straightdope.com/u/Analogue_Skywalker)\ **Post date:** [December 21, 2010, 11:54pm UTC](https://boards.straightdope.com/t/how-the-expletive-did-my-paypal-account-get-hacked/564879/40 "2010-12-21T23:54:15Z")
> [@rachelellogram](#): > > A $50 fraudulent transaction was posted through my paypal this weekend. It was flagged as potentially fraudulent by Paypal but they weren’t able to stop it in time, according to the phone rep I spoke with (something about a fleeting 7 second window). > > I did 2 virus scans, including AVG Free and trendmicro online… neither found anything at all. I never click on phishing emails. I have reliable roommates, but just the same I ALWAYS lock my computer when I walk away from it. I do not share passwords with ANYBODY. I have NO IDEA where they got my information! ☹ > > Merry Christmas… ☹ I just got the same email you spoke about a week ago. I called paypal. It was a fraudulent email. The email said it was from [paypall.com](http://paypall.com). sneaky people using two Ls to spell paypal. It said the same exact thing as your email. That my account had been frozen and needed to be verified. [Previous page](https://boards.straightdope.com/t/how-the-expletive-did-my-paypal-account-get-hacked/564879.md?page=1) [Next page](https://boards.straightdope.com/t/how-the-expletive-did-my-paypal-account-get-hacked/564879.md?page=3)