Security Codes being sent

[SGoodman]

Greetings,

I keep receiving text messages saying "Your security code is: [code] Your code expires in 5 minutes. Please don't reply."

Is someone trying to log into my account? How can I stop this?

I've already changed my password.

Thanks,

Shane.

[efraindelarocha]

Other recommendation i can give is use an authenticator instead of receiving text messages. But i will warn authenticator apps are only good till you delete them or data wipe your phone or any crucial step such as that. So basically this is not backed up on a cloud anywhere. Being said its fairly easy to make copys of your authenticator onto different devices just in case such a catostrophy would happen to you. Me myself im religious about password managers and keeping my accounts safe. I turn off all save passwords features on all browsers and only use bitwarden as my rule them all password manager. I use its password generator to generate unique passwords so that no password of mine is doubled. But again this is just me. You have to make sure you enable the auto fill correctly on android by giving your phone permissions. If anyones life here changes due to my recommendation be sure to send me a shout out. Oh and do use the bitwarden extensions on your chromium browsers and firefox browsers people. Set your setting to lock account after several minutes if its not your personal computer other wise i me personally leave it unlocked since the windows lock is good enough for my needs. Again all i need is kudos if i changed your life.

[bkenn84]

Jon does the fact that I’m receiving security code texts when I didn’t attempt to login or use PayPal mean that whoever tried my account got past the password or facial recognition phase?

[bkenn84]

Odd because all of my security codes are 6 digits.

[NonNtt]

I have been receiving the same random text messages as if I had asked for two -step verification.

I didn't even try to login should so why am I / we getting these?

Here's why:

PayPal made a (bad) decision to allow a user to login a) with a password or b) by asking for and receiving a text message with a 6 digit code.

(Users can also choose to always have a two-step verification even the do sign in with a password which is good.)

But many people now choose to just get code to login - no PW required!

They might not want to login with their password or maybe have forgotten it. I'll take the code! It's easier!

Well it's also easier for the bad guys.

Now cyber crooks/bot can simply have your email and select "send me a code" versus using a password.

PayPal  thought they were "helping" users by making logging in easier, have in fact built a new 

gateway for cyber criminals. Thanks PayPal! ITS NOT CONVENIENT when someone is trying to hack my account now by requesting 

a text instead of using a password and it's NOT ME!

Horrible security situation that PayPal created here. If they have my email and a stingray device, they 

can get in. 

PayPal should stop this option and force password login (fairly common - duh) and THEN ask for a 2nd verification via text.

Astonishing that what was (formerly) a fairly secure and hassle-free payment system, just voluntarily made their system much more vulnerable for users.

Bad call PayPal.  

Oh wait....I just another text providing me my 6 digit code that I didn't request for the second time today.

[NonNtt]

I have been receiving the same random text messages as if I had asked for two -step verification.

I didn't even try to login should so why am I / we getting these?

Here's why:

PayPal made a (bad) decision to allow a user to login a) with a password or b) by asking for and receiving a text message with a 6 digit code.

(Users can also choose to always have a two-step verification even the do sign in with a password which is good.)

But many people now choose to just get code to login - no PW required!

They might not want to login with their password or maybe have forgotten it. I'll take the code! It's easier!

Well it's also easier for the bad guys.

Now cyber crooks/bot can simply have your email and select "send me a code" versus using a password.

PayPal  thought they were "helping" users by making logging in easier, have in fact built a new 

gateway for cyber criminals. Thanks PayPal! ITS NOT CONVENIENT when someone is trying to hack my account now by requesting 

a text instead of using a password and it's NOT ME!

Horrible security situation that PayPal created here. If they have my email and a stingray device, they 

can get in. 

PayPal should stop this option and force password login (fairly common - duh) and THEN ask for a 2nd verification via text.

Astonishing that what was (formerly) a fairly secure and hassle-free payment system, just voluntarily made their system much more vulnerable for users.

Bad call PayPal.  

Oh wait....I just another text providing me my 6 digit code that I didn't request for the second time today.

[iiimilenkoiii]

Why would I need to change my password when someone is just trying to reset my email and guess my password. That makes zero since. Obviously they don’t have my password and cannot guess it. Better advice would be 2 way authentication would be the best option to secure your account if someone was making paypal to send me security code.

[yrg]

This is happening to me. Just happened 2 times in a row and again 30 minutes later. I'm concerned and don't know what to do to secure my account, if necessary.

[yrg]

Update: I added two-factor authentication and I didn't receive any more texts. So I think that may have fixed it.

[bkenn84]

I had the same weeks ago. Went on over 10-14 days. I went into my account profile and setup a passkey and did NOT change my password because it’s strong and I already had two factor authentication. Haven’t seen a security code notification since.

[datacreed]

Side info. Documenting here. I placed my first order on Temu using my Paypal account on 2024-01-22.
Probably a bad idea.
Received two unknown texted security codes since that time, 2024-01-29 and 2024-01-27. Suspect that I will get more. I'm going to go ahead and point the finger at security breach attempts from this activity. Just a guess.