Fraudulent USPS label created

[tiggientatie]

I woke up this morning to an e-mail informing me that I have paid for a $50+ shipping label to Russia. I logged in to Paypal and discovered that this was, in fact, true. I did not create such a label, of course. 

In the transaction details, there was a link for canceling the label, which I did. In requesting the cancelation there was no option to report fraud, however, so I chose to report the reason as something else (can't remember what I picked.. "changed mind" or something). Now I have to wait and see what happens with that.

I also attempted to report a fraudulent transaction with Paypal, but I don't know if I have done so correctly, as there is no immediate feedback from them. 

I also changed my account password and security questions in response. 

I should note that just the night before, I purchased an item from an on-line store (not eBay) using Paypal. I am wondering if there is a way that this transaction could have been used to generate the fraudulent postage purchase. I rarely use Paypal, so the coincidence of these two transactions seemed unusual.

I would also like to report the fraud to the USPS in some way, but I can't seem to find anything in their mail fraud reporting that seems to fit this case.

So my big question is: what else should I be doing to deal with this? Find a way to report to USPS? The purchase was linked to my Visa card, which actually provided the funds. Should I attempt to cancel the Visa transaction, or just wait for USPS to make its (up to 15 business days) decision??

Thanks!

[PayPal_Olivia · Accepted solution]

Hi tiggientatie,

Welcome to the community!

The situation that you're describing has been discussed a bit in this thread. Please feel free to read through that for a better understanding of what happened, how to get reimbursed, and how to help prevent it from occurring again.

I would recommend calling PayPal customer service. Voiding the label will not result in a credit if the label is used by the fraudster. If you call in to PayPal, a representative can get this resolved for you.

I hope this helps! 🙂

Olivia

[PayPal_Olivia]

Or, if you use Twitter, you can tweet to @AskPayPal. 🙂

[tiggientatie]

Thank you for this advice. Calling (and eventually fighting for a human being) seems to be the right thing to do. They opened a claim with USPS for me, and we'll see what happens next.

I had not seen the other thread you linked to, in spite of my searches through the forums this morning. The other individual in that thread had a seemingly identical experience (awoke to USPS charge for shipment to Moscow).

The usual explanation for this (phishing, keylogged password, etc.) seems odd because the attacker has not attempted to to reset any account information and has not made more than a single purchase, consisting of a USPS label. This really makes me wonder if there is a vulnerability in PayPal's system, which allows attacks of this nature. In the meantime, I have reset my information and configured a security key as well, so I can be relatively certain no one is logging in to the account.

[PayPal_Olivia]

Hi tiggientatie,

You're right that fraudsters with your PayPal password would likely wreak more havoc. It's not likely that the fraudster in this scenario has access to your PayPal password. It's more reasonable to suspect that an account you've created on a selling website has been compromised, and the shipping labels were printed through the billing agreement you have set up there.

For instance, if you sell umbrellas on a (fictional) site called "NothingButUmbrellas.com" and have it set up to print shipping labels via PayPal through the click of one button, the password you use on NothingButUmbrellas is the "garage door" on your PayPal account, and that password should to be guarded as vigilantly as your PayPal password. Even though it won't let someone make other kinds of payments from your account, they can do what you've established an agreement for - print shipping labels.

It could even be something you set up a long time ago for a one-shot sale and forgot about. I know I've got lots of accounts of long-forgotten websites, myself.

Does that make a little more sense?Please let me know if you need any more clarification. I'm very happy to help. 🙂

Olivia