We noticed a new login with your PayPal account associated with...

[goboso]

I'm not sure how anyone could have figured out two different passwords in a weeks time.  Could anything be generating this message other than someone actually logging into my account?  I haven't experienced it with any other online account.  

[philmee95]

All the email headers look legit, so it does not look like phishing spam emails. DKIMS and SPF. changed the email address inline below.

URL in the email actually resolves to paypal too. 

Firefox OS X

September 27, 08:26 AM PDT

https://www.paypal.com/myaccount/settings/password/edit/?<removed>

Delivered-To: <removed>
Received: by 2002:a4a:e781:0:0:0:0:0 with SMTP id x1csp3776483oov;
        Fri, 27 Se[Removed. Phone #s not permitted]-0700 (PDT)
ARC-Authentication-Results: i=1; mx.google.com;
       dkim=pass
       spf=pass 
       dmarc=pass
Received: from <removed>

Received-SPF: pass 
Authentication-Results: mx.google.com;
       dkim=pass 
       spf=pass 
       dmarc=pass 
DKIM-Signature: v=1; a=rsa-sha256; d=paypal.com; s=pp-dkim1; c=relaxed/relaxed; q=dns/txt; i=[at]paypal.com; t=1569598004; 

[goboso]

Thank you!  My passwords don't seem like something a person could guess correctly twice, so I wanted to rule out other possibilities.  

[philmee95]

I'm in the same boat. Pretty unlikely they are guessing the info. I do not have paypal on any ios device, so I don't think they hacked my apple id to do anything screwy there. Maybe paypal just sent out a few blanket emails to accounts they feel might have been compromised somehow, I do not know. I signed in yesterday and today and did not see anything odd. Changed my password yesterday just to be safe.

[goldfeld · Accepted solution]

Same here... changed the password twice already (strong passwords) and I haven't used PayPal for month than a month... seems like an error in PayPal.

[goboso]

That's what I'm thinking, too.  Thanks for your reply.

[PayPal_Olivia]

Hi @goboso, @philmee95, and @goldfeld,

I'm sorry to hear that there have been logins that you didn't make. One thing I would check is if you are using a budgeting or account management program like Mint or something similar. I have seen posts from people who use the program that say that they are getting warnings about new logins on their account, and the logins turned out to be coming from that program's access of the account, since its activity looks to PayPal exactly the same as if someone new logged in to your account.

I hope this helps!

Olivia

[philmee95]

Thanks Olivia, but I am just using the website vanilla flavor for sending / receiving money from friends and ebay payments. I do not have the app on my iPad, but I do have it on my android phone. I have not seen any mysterious transactions but did just receive money and xfer to my bank via the web page. I looked into recurring billing, but did not enable it. 

I also got another my account was accessed email from iOS which I do not use paypal on, so I updated my password for the 3rd time and then got another email about the access from iOS a day later. 13 character passwords.

[goldfeld]

Hi Olivia, I do use Mint... I will check if these messages occur when Mint update my accounts. What kind or weird is that the email says that it comes from an IP in my town (I would imagine that Mint use their own servers to access PayPal, but I may be wrong) but from a Firefox browser, which I don't use.

[goboso]

Hello Olivia, and thank you for your reply. 

I just checked Mint (which I don't really use), and see that it's not set up to download from Paypal.  I do use Quicken for Mac (not owned by intuit), and download often there.  Since I have downloaded this way for years and these messages just started a week or two before I posted, would a Quicken update be the culprit?  

This isn't really adding up somehow, but with more data it might.

Judy