Fake Paypal? Anyone else have this happen?

[Sahirah_Badr]

I'm trying to deal right now as apparently I sent a payment to a 'fake Paypal'. In checking my computer - my b/f found a Trojan.fraudload which was detected and supposedly removed by my antivirus.

That day I went to pay for something here on Bhuz, I clicked a link into Paypal and paid it. I also paid a few other bills. Imagine my suprise when I started accruing late fees for several items I 'paid for' on that day. Checking my Paypal, I see now an invoice for the Bhuzzer's item - but it is marked unpaid.

Weirdly still, I paid yet another Bhuzzer AFTER that date and she was paid with no problems.

So... has anyone else run into a fake Paypal site? I have notified my bank, but has anyone gotten their money back? I'm out $700 right now, which is not small change. UGH......cr.:

[Lara L]

I am so sorry this happened to you! I am a bit confused at *how* it happened, since no other site should have had your password & account information.

Have you filed a police report yet?

[dunyah]

Oh, that's awful! I'm so sorry that happened to you. I've always understood not to click on any link to PayPal but to open a new browser window and type in the address manually.

Although I have successfully clicked on the button that says Pay by PayPal on certain websites with no problem.

Was it one of those button things on a website?

[Sahirah_Badr]

@Lara -I clicked a link to pay an invoice. I thought the Paypal logo looked a bit odd, but it seemed to me to be the site. Yet when I log onto my own paypal, that 'payment' isn't there but my bank shows a payment made.

I haven't filed a police report yet until the bank does their investigation first. I'm disputing the charges and hopefully it will return the funds.

@dunyah -yes it was an invoice I'd never had issues with that before. I think I was so overwhelmed that day and trying to rush I didn't look carefully. My computer now seems to have no further issues with that trojan, but apparently it seizes passwords/log ins, so have been changing those on another computer that wasn't compromised.

[Lara L]

hmm- sounds more like a paypal problem to me- how would the fake site get your bank info, unless you added a card or something to pay for it? Have you tried contacting paypal?

Sorry if this is unwanted advice- I am sure you are doing everything you can to resolve this- how totally awful!

[Sahirah_Badr]

I have a debit/Visa linked to my bank acct on my Paypal, then it draws from my bank acct. But really - I am not sure. It isn't making sense.

If it had been one incident, I'd have disputed the charge, notified Paypal and been done with it, but it was about 6 transactions all in the same day. Two were done via my bank, so it seems like I had been hacked or the payments were being rerouted to another address.

I wish I'd been more careful, as this will be a helluva costly mistake. :(

[Elibelinde]

Oh this is awful!

I get fake Ebay and Paypal emails, probably we all do. I'm really careful not to click on anything if they look at all weird, in fact I don't click on anything period. I figure if it's important I can go right to the site and do whatever.

People are getting really good at faking Paypal and/or Ebay.

An actual invoice though - this is actually pretty scary.

I'm sure you will get your money back though since it's a fraud. But maybe you should double check to make sure your identity is secure.

[Reinaa]

I hope you get your money back. Has the money been claimed? I send money to a wrong paypal address once and got my money back but it took 30 days. Who is the BHUZZER by chance?

[Jaseena]

This is weird as I have had a paypal account for 10 years now and no problems. Please ensure you see an https://www.paypal.com before logging into your account. Also, report any fraud to paypal - supply them emails, email addresses - whatever you can.

If you get an invoice via email, I DON"T click on it, log into you account and do it from there.

[Sahirah_Badr]

Thanks Ladies. You know -I've had this Paypal 15 years and never once had this happen. I know it is NOT the Bhuzzer's fault as I asked her to invoice me (that way she can add PP fees and her shipping fee) I've done this before, it's not been a problem.

That day my spyware caught a weird trojan, and I have a feeling it had something to do with it. My bank is on the case and we're filing disputes and seeing what we come up with. It really DID look like the Paypal site though.

What was different is on my bank statement - it normally says Paypal and minus the $ amount. What I saw from my bank is that dollar amount and a code instead of Paypal, so that was an alarm bell right there. It looks good to get my money back - but we'll see, might take a few weeks. :(

[coffeegoddess]

Sounds like you were phished. That link you clicked did not take you to Paypal but to a dummy site. You "logged in" but since you weren't actually on Paypal's site, that transaction won't show on your Paypal. Once the scammers got your Paypal login and password it would be very simple to get your bank account information. The actual site itself probably downloaded the virus to your computer.

You were right to contact your bank but make sure to contact Paypal as well. There are several good sites that tell you how to avoid phishing scams. Just google "phishing" and you'll find a lot of information.

[maurazebra]

This is becoming a very big issue everywhere, even and especially on Google. Advertisers don't have time to vet all the advertisements and the internet mafia (literally) is taking over. I love the Internet but I give it six months before it is almost unusable, now that extremely clever viruses / trojans that divert all search result links are hitting the streets.

[Sahirah_Badr]

@Coffegoddess - is exactly what I felt after I saw the code on my bank statement, and the Bhuzzer had been patiently asking why my payment was still pending. Turns out it is IN my real Paypal, asking for payment (I checked on another computer that wasn't compromised). ARGH! I have since contacted Paypal. They really cannot do much, as they never 'saw' it. It never registered with them, all they will see is the Bhuzzer asking for payment and it is pending.

@Maura -I'm always the one warning my kids - don't click on this that, watch for this, don't download anything etc and see what happens? *sigh* Worse yet, this all went down on my birthday... :(

The offending virus/trojan is now gone, as I have really good spyware/virus software and a b/f who makes sure it's not hiding elsewhere in the system! I agree -I'm staggered by the amount of phishing, and how creative the hackers are getting. I hope Bhuzzers don't mind I'll be sending checks/money orders when I buy for a while.

[dunyah]

So how in the world did the phishiers know exactly what information to put on the phony invoice? They had to have the name and email of the Bhuz seller, and the exact amount of the purchase, right? That is freaky.

[steffib]

If you have reason to suspect that your machine was seriously compromised, the best choice is to wipe your computer, reinstall everything from the original media and then restore data etc. from a know-to-be-clean backup. I would not rely on virus removal programs in a situation like yours.

[Elibelinde]

So how in the world did the phishiers know exactly what information to put on the phony invoice? They had to have the name and email of the Bhuz seller, and the exact amount of the purchase, right? That is freaky.

That is scary!

I wonder if the Bhuz seller didn't have a worm herself? That is probably the only way this could work right?

Bad code can apparently be downloaded by apparently innocent images or maybe even embedded in videos and definitely via executable files in emails. So inadvertently we get a worm then send an invoice which is infested?

Bummer.

[BELLA_BELLA]

So sorry to hear about this, but thanks for sharing your woes. I'm going to change my modus operandi to be even more careful with Paypal.

[*Shira*]

@Lara -I clicked a link to pay an invoice. I thought the Paypal logo looked a bit odd, but it seemed to me to be the site. Yet when I log onto my own paypal, that 'payment' isn't there but my bank shows a payment made.

This is my theory as to what happened. Bear in mind, I could be wrong, but since folks on this thread have shown a lot of concern wondering how it could have happened, here's a scenario that indeed could have happened.

The Trojan may have installed itself on your system in the past, BEFORE you received that invoice. It may have contained the following functionality:

• Spying on the data going in and out of your Internet connection, looking for items that met certain criteria. In particular, it may have been snooping for a PayPal payment request.
• Intercepting the connection between your keystrokes and your Internet connection, then substituting its own url. Ie, if you clicked on a legitimate link to PayPal, it may have intercepted that and substituted its own url, taking you to its own look-alike web site. Once you arrived on that look-alike web site, it could prompt you for your paypal id and password, and recorded that information for its own nefarious purposes.
• It would have then been a simple matter for the creator of that trojan to go to paypal, log in with YOUR user name and password, and create a transaction that would cause you to pay the expected amount but to THEM rather than to the party you INTENDED to pay.

Also, even you thought you removed the trojan, you may have cleansed it from your hard disk but maybe it was still in memory and still able to act until your next reboot. Any time you remove a trojan or virus from your machine, it's a good idea to reboot to ensure that it is cleansed from memory.

Again, I don't know whether any of the above actually applied in your situation, but it's theoretically possible that this is how it worked.

[Sahirah_Badr]

This is my theory as to what happened. Bear in mind, I could be wrong, but since folks on this thread have shown a lot of concern wondering how it could have happened, here's a scenario that indeed could have happened.

The Trojan may have installed itself on your system in the past, BEFORE you received that invoice. It may have contained the following functionality:

• Spying on the data going in and out of your Internet connection, looking for items that met certain criteria. In particular, it may have been snooping for a PayPal payment request.
• Intercepting the connection between your keystrokes and your Internet connection, then substituting its own url. Ie, if you clicked on a legitimate link to PayPal, it may have intercepted that and substituted its own url, taking you to its own look-alike web site. Once you arrived on that look-alike web site, it could prompt you for your paypal id and password, and recorded that information for its own nefarious purposes.
• It would have then been a simple matter for the creator of that trojan to go to paypal, log in with YOUR user name and password, and create a transaction that would cause you to pay the expected amount but to THEM rather than to the party you INTENDED to pay.

Also, even you thought you removed the trojan, you may have cleansed it from your hard disk but maybe it was still in memory and still able to act until your next reboot. Any time you remove a trojan or virus from your machine, it's a good idea to reboot to ensure that it is cleansed from memory.

Again, I don't know whether any of the above actually applied in your situation, but it's theoretically possible that this is how it worked.

Shira, this is what my b/f thinks may have happened. Whatever it was that snagged me - it sure was a sophisticated copy, enough to look like my 'usual' circumstance. I had been using my daughter's computer for a few days while this one was wiped/reinstalled for safety reasons. .p::

Hackers are getting smarter and smarter, and even with the best of antivirus software, I can only imagine they are finding it fun to challenge themselves and break in another way. I'm this way as far as technical stuff is concerned:-----> ..c:: but I am doing my best to educate myself to learn as much as I can to prevent it from happening again.