Basically just right now I got a text on my phone giving me a code that expires in 5 minutes. The scary thing is that I've never used paypal ever in my life. Is this just someone mistyping his phone number or a hacking attempt?

  • First time using this board so sorry if this is the wrong one – MrSomeone Sep 11 '17 at 17:40
  • I would try logging into PayPal to see if anyone has created an account under your email. You will most likely get a generic error message so you might need to reset password to find out for sure. – Trickycm Sep 11 '17 at 18:45

I wouldn't be so concerned, yet, as it's quite probable that this was merely a mistake in entering information.

Paypal sends a confirmation when you first set up 2FA (two-factor authentication), to verify that you've entered your number correctly. If you don't have a paypal account, the most likely cause of your receipt of such a text is that somebody has tried to set up 2FA for their own account, but mistyped their number as yours.

In theory, they shouldn't be able to validate using your phone number (unless they have access to your phone), and so Paypal will reprompt them for a different number.

If your email address has been used, then you might have something to worry about! As Paypal uses email address as the primary factor of authentication (you can't sign up or login using the phone/text factor alone), the only person who should have access to use Paypal with your email address is you! There's no information in this question to suggest that this is the case, as you haven't indicated that you received emails from Paypal, so I'm going to assume this is out of the scope of the question. Suffice to say, if this were your case, secure your email account and work out what to do with nefarious (or perhaps, lack of) funds...

In addition to sending a confirmation when you first set up 2FA, Paypal will send a confirmation for every login there-after (providing you managed to successfully complete the challenge during confirmation). As you haven't mentioned receiving multiple such messages, I'd suggest that your receipt wasn't one of these.

Even if someone has successfully used your phone number to authenticate (implying that they somehow obtained the verification code sent to your phone in order to successfully set up 2FA using your phone number), there's still much less to worry about than the email address compromise scenario above. It's possible that someone could have compromised your phone (in which case, you'd need to restore your phone to factory conditions and reset all associated passwords), but again, there are other much simpler explanations to be aware of.

For a start, an attacker might not need to compromise your phone to intercept those 2FA codes; some attacks involve keeping you busy (literally; the attacker will call you while Paypal is trying to call you, as the code can be retrieved as a phone call for the visually impaired) so that the Paypal verification code goes to a message bank service. So make sure your message bank configuration is correct, and your missed calls aren't being forwarded to some nefarious message bank service.

Even still, thanks to VOIP forging attacks, attackers can retrieve such a verification code from your legitimate message bank service by making a call from your number (even though they haven't got your SIM card) to your message bank. So better yet, disable the message bank service altogether!

However, again, I note that you've not mentioned any symptoms of message bank compromisation, so I'm going to assume that's also irrelevant here. Be vigilant of Paypal confirmation messages sent to your message bank (or disable your message bank entirely)...

In summary, it's most likely that someone merely entered their own (very similar) phone number incorrectly, and you won't receive another verification text. However unlikely, it's possible that someone could have access to your phone, or your message bank service, but I wouldn't worry about that unless you see symptoms of such a compromise... Always be vigilant of such compromises!

To clarify, Paypal will send a confirmation:

  • when you first set up 2FA (and this could be a mistake, which would result in Paypal correcting the issue very soon)
  • providing you successfully set up 2FA, for each login there-after (and this would be your indication to get on the phone to Paypal, remedy the issue, and work out what else was compromised)

It sounds like a smishing attack. (Smishing is a cute word that is a portmanteau of "phishing with SMS text messaging".). Certainly do not respond to the message. You can report it to your cell carrier at 7726 (S-P-A-M).

  • But it said to not reply. Is it a bad attempt or what? – MrSomeone Sep 11 '17 at 18:00
  • 1
    It could be some other person put in your mobile number as their recovery number. This could have been an accident, or it could be a deliberate attempt to access your account. Either way, I would not use that mobile phone to log into PayPal until after you log in on your home PC and change your PayPal password. – John Deters Sep 11 '17 at 19:27

Not the answer you're looking for? Browse other questions tagged or ask your own question.