# Someone else used my paypal account. **URL:** \ **Category:** Miscellaneous and Personal Stuff I Must Share\ **Created:** [March 10, 2005, 4:09pm UTC](https://boards.straightdope.com/t/someone-else-used-my-paypal-account/293852 "2005-03-10T16:09:12Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Brendan\_Donovan](https://avatars.discourse-cdn.com/v4/letter/b/bbce88/32.png) [@Brendan\_Donovan](https://boards.straightdope.com/u/Brendan_Donovan)\ **Post date:** [March 10, 2005, 4:09pm UTC](https://boards.straightdope.com/t/someone-else-used-my-paypal-account/293852/1 "2005-03-10T16:09:12Z")
For a week I have not been able to log into the hotmail account that I used with my paypal account. I thought it was no big deal since hotmail had had a little trouble rolling out the 250mb mailbox and I don’t use it often since I have been migrating to gmail. Still, a couple of days later I checked my credit card statment and found a rather large paypal debit. I go to check on my paypal account and found that it had been restricted. Turns out someone used my name to make a $1500 CAD purchase on ebay for a laptop. The purchase date ws 3 march. I called the bank and disputed the charge and I called paypal and initiated and investigation for anauthorized access. This should work out well since I e-mailed the seller and found that he was a little suspicious of sending the laptop to a third unknown address (I have the address now as well) and the buyer 550tommy is no longer a registered ebay user. Palpal should get back to me within 10 days. I think it might work out. But I m at a loss to figure how they got my password. I never respond to phising e-mails and had password that was not easily guessed. ---
**Author:** ![Bosda\_Di\_Chi\_of\_Tricor](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bosda_di_chi_of_tricor/32/16845_2.png) [@Bosda\_Di\_Chi\_of\_Tricor](https://boards.straightdope.com/u/Bosda_Di_Chi_of_Tricor)\ **Post date:** [March 10, 2005, 4:26pm UTC](https://boards.straightdope.com/t/someone-else-used-my-paypal-account/293852/2 "2005-03-10T16:26:09Z")
Check your computer for viruses/spyware. You been hacked, by golly. I’d give you 3 to 1 odds. ---
**Author:** ![AngelicGemma](https://avatars.discourse-cdn.com/v4/letter/a/439d5e/32.png) [@AngelicGemma](https://boards.straightdope.com/u/AngelicGemma)\ **Post date:** [March 10, 2005, 9:23pm UTC](https://boards.straightdope.com/t/someone-else-used-my-paypal-account/293852/3 "2005-03-10T21:23:48Z")
That sucks. I hope you can get this sorted quickly. ---
**Author:** ![Brendan\_Donovan](https://avatars.discourse-cdn.com/v4/letter/b/bbce88/32.png) [@Brendan\_Donovan](https://boards.straightdope.com/u/Brendan_Donovan)\ **Post date:** [March 11, 2005, 1:39pm UTC](https://boards.straightdope.com/t/someone-else-used-my-paypal-account/293852/4 "2005-03-11T13:39:41Z")
> [@Bosda Di'Chi of Tricor](#): > > Check your computer for viruses/spyware. > You been hacked, by golly. > > I’d give you 3 to 1 odds. Good instinct. I ran spybot s&d and ad-aware and all I turned up was benign Viewpoint media player (getting rid of that crap is another story). I also ran an additional virus check and was clean. I run these tools often so I was not really sure that I was going to find anything on my system but then I checked the Zone Alarm program control and guess what. In there I found that a program called sys.exe was logged. I don’t know how this came on or when it left so I’ll go back to the spybot log to find out. A quick google search found that it is part of a keylogging scumware. I don’t know how long it was on the computer but at least long enough to get the info to get into paypal :mad: . Its gone now but just to be sure I am going to comb through all files and in the registry to be extra sure. I’ll let everyone know how this works out. God damn them all, I am so bloody furious and I feel so crap :mad: :mad: ---
**Author:** ![Brendan\_Donovan](https://avatars.discourse-cdn.com/v4/letter/b/bbce88/32.png) [@Brendan\_Donovan](https://boards.straightdope.com/u/Brendan_Donovan)\ **Post date:** [March 11, 2005, 1:56pm UTC](https://boards.straightdope.com/t/someone-else-used-my-paypal-account/293852/5 "2005-03-11T13:56:35Z")
Here it was… Took only one day to get in and out. From my Spybot log: > [@](#): > > — Report generated: 2005-03-04 06:08 — > > Wget.Trojan: Settings (Registry key, fixed) > HKEY\_LOCAL\_MACHINE\SOFTWARE\Wget > > Wget.Trojan: Settings (Registry key, fixed) > HKEY\_USERS\S-1-5-21-3683679437-2915903831-1203752577-1006\Software\Wget > > Viewpoint: Settings (Registry key, fixed) > HKEY\_USERS\S-1-5-21-3683679437-2915903831-1203752577-1006\Software\Viewpoint\Content Debugger > — Spybot - Search && Destroy version: 1.3 — > 2005-03-03 Includes\Cookies.sbi > 2005-03-02 Includes\Dialer.sbi > 2005-03-03 Includes\Hijackers.sbi > 2005-01-11 Includes\Keyloggers.sbi > 2004-11-29 Includes\LSP.sbi > 2005-03-02 Includes\Malware.sbi > 2005-03-03 Includes\PUPS.sbi > 2005-03-03 Includes\Revision.sbi > 2005-02-09 Includes\Security.sbi > 2005-03-03 Includes\Spybots.sbi > 2005-02-17 Includes\Tracks.uti > 2005-03-02 Includes\Trojans.sbi Irony is I ran spybot the same day that the account was used.