Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Some time ago, probably about 6 months, somebody hacked my email account and used gmail settings to forward my emails to him/her.

I noticed that, removed the forward and changed the password. Now, I use another gmail account for my paypal account and I never had a paypal account on my hacked gmail account. I logged in and thought that I should add my other gmail account to this paypal account as well.

But, to my surprise, paypal informed me that this email is already used ! I tried to reset the password, to found out that a specific credit card information was requested, after I asked for a password reset. You cannot actually reset the password if you do not provide that information (which of course I don't know).

I also checked my inbox for Paypal emails and I actually found a few of them, some newsletter stuff. I suppose that the attacker forgot to turn them off ? Seems weird indeed. They actually also have my name on it, though I don't really provide that info on gmail :O

I don't really understand why would somebody want to create a paypal account with another person's email. I don't find any reason for that, but I may be missing something.

Has anything like that happened to anybody else ? Is there a way that you can advice so that I can further check on that and get more information ? I will probably also call paypal.

share|improve this question
    
I would like to know if you ever resolved this. Something similar happened to me where someone created a Paypal account and seems to be using my email address as their secondary address. I say that because when I type my email address into Paypal and click that I forgot my password it says there is no account associated with that email address. However, when I contacted Paypal they said that indeed someone signed up for an account and is using my email address. None of my personal or credit card information is associated with the account however, so it must have been in error. Paypal said they –  user7091 Jan 22 '12 at 3:36
add comment

2 Answers

A couple of clues that comes in my mind:

  • Is the account active? If yes you should receive payment information from Paypal regularly. This activity would be a good sign to see whether it is your account (you could have forgot) or another person, or a person trying to harm you.
  • Maybe there is a person with the same name as yours and he accidentally typed your email instead of his?

By the way, contacting PayPal is indeed the good thing to do. They would normally try to be sure that :

  • They understand the situation and are aware of possible mischief
  • You own the email address
  • You are the same/a different person than the other account

You want to :

  • Check you did not have any money theft
  • Someone is not trying to impersonate you somewhere (difficult to assess in my opinion)
share|improve this answer
    
I am not receiving any payment information, maybe the attacker has abandoned the account. However, every now and then, i notice that i receive some Paypal news. Really rare, like once every two months, haven't even noticed that before. I also suppose that you have to verify your email address before Paypal accepts it. Therefore, i think it's highly unlikely that someone just typed his email wrong. I actually don't have any money theft(impossible since it's just a new Paypal account that the attacker owns). Impersonation was my main concern though, as you say. –  johnakon Aug 11 '11 at 13:57
    
The first thing i was thinking is that maybe i have created this account in the past. However, i seriously don't remember having any other Paypal account except from the one i have for many years now. I'm quite certain i haven't created this account. Moreover, there is a credit card associated with it that ends with a number i am not aware of(i saw it on password reset questions). Really really weird situation. –  johnakon Aug 11 '11 at 14:01
1  
You may want to check your email filter settings in Gmail - they can be set in a way that they'd automatically delete any payment-related emails from PayPal. –  MicE Aug 14 '11 at 11:57
add comment

Most probable goal would be to use fraudulent/stolen credit card numbers (not your card, just any card). By now the card would have been blocked by the bank, which explains why there is no more activity on this paypal account, but the account remains created.

Also by the past PayPal had some trouble facing money laundering and tax evasion, with money passed automatically from hand to hand between a large number of "zombie" Paypal account. They regularly update their use policy and add several technical systems ("verified" users and so on) in order to prevent such abuse, but this is the endless race between the policemen and the thieves.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.