Unauthorized bank transfer wiped out my PayPal balance

[nitorinitori]

Hi I received an email from paypal yesterday January 19th 2024, at 1:30AM (GMT+9), saying that i've transferred my entire balance to unknown and unauthorized "East West Bank". I tried to call PayPal once, and they quickly denied my dispute saying that I authorized it. I tried to give them a call once more time and currently the case is still in review. I really do hope that it get resolved. I'm worried that if they does not put that unauthorized transaction on hold while I'm waiting for the dispute to be resolved. My PayPal account region is in Indonesia, which means I can only put Indonesian bank. For some reason "East West Bank" which seem to be a bank in Phillipines got entered. PayPal should've put an OTP request for every suspicious actions like adding new bank account or transferring money. Mind you that I have strong password and 2FA turned on for a long time.

[Grimreepr]

Do you use PayPal on your phone?  If so, are your 2fa features on the same phone.  If your email, authenticator are on the same phone as the one the SMS messages are coming to, then your 2FA security means nothing.  Anyone that clones or has access to your phone will have access to all that information and since it is all neatly bundled in a single package, you are in a deep deep puddle of ucky doo doo.

Another question, do you use public WIFI at all?  Have you ever used PayPal on a public WIFI?  Do you use a VPN at all?  VPN's Encrypt data from the sender to the exit point on the VPN's network.  So even if someone is trying to steal information on an unsecured public WIFI, your data will be encrypted and useless.

With everything on one device, it would take a professional less than 30 seconds to empty a PayPal account.

3 never's to live by:

1. NEVER share passwords

2. NEVER use online banking on a public WIFI.

3. NEVER put all your 2fa eggs in a single basket.

Honorable mention:

4. Never tell your wife she's "putting on a few"

[nitorinitori]

Thanks for the reply I usually use my PayPal only on one of my PC, and I have app 2FA on my phone. And yes, I do all the PayPal stuff only on my home WiFi

[nitorinitori]

Have you had luck tried contacting or calling PayPal ?

[danialfin]

I am from indonesia, I have reported the problem this unauthorized transaction to PayPal Resolution Center but after they reviewed, the result is: "We've reviewed your unauthorized activity case, and determined that there was no unauthorized use of your PayPal account." and then Case Closed and cannot report this problem again! what happened?

[nitorinitori]

Yeah I had the same answer. I think you can try to call them again. I tried for the second time this morning and I haven't got an answer

[danialfin]

I leave message on their Live Chat.

just rightnow I update use 3 security layer: Biometric (fingerprint, 2 Factor, and Complex Password. I'll see tomorrow is the account safe?

[g305]

Same thing happen to my account around on 1/18/24 and today 1/21/24. Paypal is not help and closed my case saying I authorized it. I requested an appeal and if they decline it. I just rather not use paypal going forward. 

[PayPal_Meghan]

Hello @nitorinitori, @Grimreepr, @danialfin, and @g305, 

Thanks for stopping by and posting in the PayPal Community Forum! 

I'm sorry to hear that you've all had unauthorized account access and your cases were denied @nitorinitori, @danialfin, and @g305, An unauthorized dispute through PayPal can only be approved when it can be determined that you were not the one who logged in to make the transaction. The most common reason I've seen cases denied quickly was because there was a pre-existing subscription on the account. When there's a pre-existing subscription, that means the unauthorized access occurred through the merchant's website and not PayPal. If you find this was what happened, please get in touch with that merchant immediately to let them know what happened. 

It sounds like everyone may have opened an appeal already through Customer Support, and I'm glad to hear that. If you need to cancel any subscriptions, please visit this Help Center article. In addition to the fantastic tips @Grimreepr mentioned for ensuring your account is secure, please also reset your password and security questions if you haven't already. I understand some of you have set up 2-Step Verification, but just in case, here's an article for more information on it. Another common way for fraudulent people to discover your account information is through phishing emails; please click here to learn how to spot and report them. 

I hope this information helps and everyone is able to obtain a refund with their appeal! 

- Meghan

[nitorinitori]

Thanks for the response.

I want to clarify that I have no subscription enabled nor auto payment ever on my PayPal. Even if it's subscription payment, there is no way it would wipe out our entire PayPal balance transferred to an unknown bank account. 

I wish next time PayPal would require 2FA on every important actions such as making a new bank account, doing a transfer, even just changing a password.