Scam phone call from PayPal security

[Haunter559]

So I got a phone call today from "PayPal security" - they told me my email address, my name, phone, address, and asked me to confirm... Immediate red flags, they then told me my password and asked to confirm that.... Immediately logged in to change it and to throw on two factor authentication... Went into the login logs and noticed iOS devices (I don't have apple products) logged in yesterday.... Really scary and I was curious why they tried to ask me for infor when they already had it. How did they get my info in the first place? Was there a breach?

[PayPal_Olivia]

Hi @Haunter559,

Thank you for your post and welcome to the PayPal Community!

It's so great that you were cautious! An employee would not know your password, and would not disclose any sensitive account-specific information to a PayPal member, even if they thought they were speaking to the owner of the information. That was almost certainly a fraudster.

A fraudster who's equipped with multiple pieces of information may potentially try to get you to divulge further information, such as passwords or financial information. They may also try to convince you to allow them to remotely access your computer, or to pay them money for something. I'm super glad you were cautious, as that caution potentially prevented any of that from happening in this case, and would in the future if it ever happened again.

How could a fraudster gain that information? It's impossible to know for sure exactly how, but creative fraudsters can find quite a bit of the type of information you described with enough searching on the internet, especially if your password has found its way onto a list of compromised passwords. If you've used the same password on multiple sites, it's possible that a less secure site was compromised and the fraudster tried the password and email address on PayPal. It's also possible that your computer or a network that you've used was compromised, and the information was gained in that way. I would recommend running a virus scan on your computer or device, and changing any passwords anywhere that the same password was used. Choose strong and unique passwords that aren't being used anywhere else. More tips can be found here. 

Using the caution you showed and choosing not to divulge further information is one of the best defenses. You can also usually log in to your PayPal account on your own to check if there are any steps or actions that need to be completed if you are actually contacted legitimately and a PayPal employee wants you to do anything. 

I hope this helps!

Olivia