Yesterday my housemate was almost scammed by someone on the internet, or so I thought. She was selling some goods on a ebay-like website, and someone contacted her to buy her stuff. She then received a false email from "Paypal" telling her she had received a certain amount of cash (which was not exactly the one she asked, thus she thought something was wrong) from that person.

By error she clicked a link in the mail, allegedly linking to a PayPal payment reference. She said nothing was prompted to her, or downloaded and she exited the opened webpage immediately.

Later that day, she realized her PayPal credentials were not valid anymore, and when she tried to change them by asking new ones, the codes she got on her phone by SMS were not working at all. She had to contact PayPal support directly for help, and now her credentials work once more. She think nothing was stolen from her account in the mean time.

Could possibly the two events be linked ? Could it be that by a simple phishing attempt an attacker managed to retrieve her credentials even though she was not prompted a false PayPal login page ? If yes, how ?

  • yes, her credentials were stolen by the fake page – schroeder Jun 12 '17 at 12:02
  • 1
    The fake paypal link may launch exploit script without prompting. – mootmoot Jun 12 '17 at 12:40
  • I was not sure such methods did exist. So just by clicking the malicious link it was over ? I checked it myself by hovering and the link really seemed legitimate. By that I mean the domain name seems the good one (www.paypal.com, using https by the way). Yet it couldn't be a real link : no payment was made, the reference to a payment must be false. – Kaël Jun 12 '17 at 13:03
  • @schroeder How? If she did not enter them (easy to recall incorrectly, though), I don't see how this could work. – Anders Jul 9 '19 at 7:42

Yes it's possible especially if the housemate was already logged into PayPal or checks "keep me logged in", the attacker may have found a way to hijack the session , run a script to hook the browser , or an exploit is possible as well.

Then the attacker logged in and probably changed your email , and/or password and/or 2 factor number to control your account.

Check your transactions to ensure nothing else was sent or received.

  • 1
    Can you change password or authentication method without having to reenter your old password on Paypal? If this was only session hijacking, the attacker don't know the old password. – Anders Jul 9 '19 at 7:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.