“The safety and security of our customers’ accounts, data and money is PayPal’s highest priority. Update 2: Here is a statement given to us tonight by PayPal: The way I read this, your PayPal account is eminently hackable, PayPal does not offer the kind of two factor authentication that allows you to require a text to your device, or the ability to limit transactions to specific blessed devices. This is the ultimate and most sophisticated customer authentication system that PayPal has: Send us a copy of your driver’s license. Also, let’s forget for the moment that there are a half-dozen services online that let customers create fake but realistic looking scans of all types of documents, including utility bills, passports, driver’s licenses, bank statements, etc. Nevermind that it was PayPal’s lack of any modern authentication methods that led to this mess. The supervisor explained that the company didn’t have any mobile authentication technologies, and that in order to regain access to the funds in my account I had to send the company a photocopied or scanned copy of my driver’s license.

I asked the PayPal supervisor why the company couldn’t simply verify my identity by sending a text message to my phone, or a special signal to a PayPal mobile app? After all, PayPal has had the same mobile number of mine on file for years (the attacker also deleted that number from my profile as well). So much for PayPal’s supposed “monitoring ” the company couldn’t even spot the same fraudulent email address when it was added a second time. But by the time I got back home to a computer, my email address had been removed and my password had been changed.

Twenty minutes later I was outside exercising in the unseasonably warm weather when I stopped briefly to check email again: Sure enough, the very same rogue email address had been added back to my account. The representative assured me they would monitor the account for suspicious activity, and that I should rest easy. I then called PayPal and asked how the perpetrator had gotten in, and was there anything else they could do to prevent this from happening again? The customer service person at PayPal said the attacker had simply logged in with my username and password, and that I had done everything I could in response to the attack. I immediately logged into my account from a pristine computer, changed the password, switched my email address back to to the primary contact address, and deleted the rogue email account.

On Christmas Eve morning, I received an email from PayPal stating that an email address had been added to my account.

Brian Krebs, the name behind Krebs on Security, on his PayPal account getting hacked on Christmas Eve:

Hacked paypal accounts