Low End Mac Reader Specials

TypeStyler For Mac OS X is Now Shipping! Download The Free Fully Functional 60 Day Tryout at www.typestyler.com

OWC: Mercury On-The-Go FW800+USB2 up to 1.0TB. Bus Powered, no external power supply needed. Macworld ‘Editor’s Choice’, CNET ‘Very Good’ Starting from $99.97, 500GB $159.99. Click here

Poker Mac Don't install Parallels to play poker online! Poker Mac will show you how to download and install a native Mac poker application such as Full Tilt Poker Mac.

Laptop Hardware Provided by TechRestore - Overnight Mac & iPod Repairs.

Compare products like desktop computers, apple laptops, apple macs, and LCD Monitors side by side! All the information and reviews to make the best purchasing decision for new mobile phones, sat nav systems, or MP3 players. The Ciao online shopping community makes searching products easy for you.

Mac Musings

Good News, Bad News, and PayPal

Dan Knight - 2002.08.26 - Tip Jar

The good news: I received a letter from the MasterCard Card Center on Saturday. They have credited my account the $1,444.00 taken when someone hijacked my PayPal account a few weeks ago.

The bad news: I made a small deposit over the weekend, but the balance seemed lower than it should have been after the return of that money. You guessed it: PayPal has taken more money from my business account to cover unauthorized payments. This time it's $878.55.

And now there's enough in the account for the other disputed amount, $887.36, to clear if/when PayPal tries to clear the transaction again. I somehow wouldn't be at all surprised if PayPal takes it, too.

So much for PayPal locking my account and canceling all of these unauthorized transactions. Time to file more paperwork with the bank, update my file with the Internet Fraud Complaint Center (run by the FBI and the National White Collar Crime Center), set up a new business checking account, and clear out what little remains in my current account, shred that box of laser checks, get a new debit card, and change any payments on the current card to the new one.

So much for paying the bills or cutting a paycheck.

And I still don't have access to my PayPal account to find out exactly who "lilbb@spils.com" sent my money to.

PayPal Insecurity

Over the weekend, I sent some funds using my personal PayPal account, which I changed to a more secure password 4 weeks ago. When picking the person to send the money to, I was surprised to find lilbb@spils.com listed, so I searched for any transactions involving that email address.

What I discovered is that lilbb@spils.com is still the primary address on my business PayPal account. The folks at PayPal have not removed the address from my account.

I also made some more interesting discoveries about the way PayPal works. I decided maybe it would be best to remove some email addresses on my other account, and when I deleted the first one, PayPal asked me to verify this by entering my checking account, debit card, or social security number.

Wow, I thought, maybe they've learned their lesson about security.

But when I attempted to add another email address, no such request. It does show the new address as unconfirmed, does send out an email telling me about the change, but that seems to be it. PayPal doesn't require any further confirmation - but they do ask you to contact customer service if you didn't authorize the change. Of course, by then it may be too late.

You have added <email address> as a new email address for your PayPal account.
 
If you did not authorize this change or if you need help, please contact customer service at:
 
https://www.paypal.com/ewf/f=ap_email
 
Thank you for using PayPal!

I also changed the primary email address on my PayPal account, since I won't pay Apple to keep my mac.com address, and I also removed that address from my PayPal account. I did this in a completely separate session, yet PayPal didn't ask for the same kind of proof they did when I removed the first email address.

Account Links

Once you've created a PayPal account, you don't have to keep it linked to a credit/debit card and/or bank account. Removing a credit card from your account means that you can't make credit card payments via PayPal - and that could be a very good thing just in case your account is ever hijacked.

Removing a bank account not only eliminates the ability to electronically transfer funds between your bank account and your PayPal account, it also turns your account into an unverified one. Although that protects your bank account, it also puts in place a credit card charge limit. For personal accounts, that means that you can't accept any funds sent via credit card.

It also means that you'll have to wait 1-2 weeks for PayPal to send a check when you want to remove funds. There are serious disincentives to disconnecting your PayPal account from your bank account.

Summing Up

I understand how lilbb@spils.com managed to hijack my account - guess the password. That's all it takes. Nothing more.

Once you've done that, you can change the account password(s), add your email address, and then make your address primary. Just like that, you've hijacked a PayPal account. Now spend the money quick before the owner reads the email about the new address being added.

Four weeks after the hijacking, I'm beginning to wonder if I'm ever going to get my account back. At least my bank has been able to get back the money taken fraudulently, but PayPal hasn't done much more than keep trying to cover more unauthorized transactions by taking money from my business bank account.

And that's bad news indeed.

Dan Knight has been using Macs since 1986, sold Macs for several years, supported them for many more years, and has been publishing Low End Mac since April 1997. If you find Dan's articles helpful, please consider making a donation to his tip jar.

Recent Mac Musings

Links for the Day

Recent Content on Low End Mac

Recent Deals

About LEM | Support | Usage | Privacy | Contacts

Entire Low End Mac website copyright ©1997-2009 by Cobweb Publishing, Inc., unless otherwise noted. All rights reserved. Advice presented in good faith, but what works for one may not work for all. Please report errors to .
  LINKS: We allow and encourage links to any public page as long as the linked page does not appear within a frame that prevents bookmarking it.
  Access our RSS news feed at http://lowendmac.com/feed.xml.
  Email may be published at our discretion; email addresses will not be published without permission, and we will encrypt them in hopes of avoiding spammers. If you prefer your message not be published, mark it "not for publication." Letters may be edited for length, context, and to match house style.
  PRIVACY: We don't collect personal information unless you explicitly provide it. For more details, see our Terms of Use.
  Low End Mac is an independent publication and has not been authorized, sponsored, or otherwise approved by Apple Inc. Apple, the Apple logo, Macintosh, iBook, iMac, eMac, iPod, iPhone, PowerBook, MacBook, MagSafe, Mac Pro, Apple TV, and AirPort are registered trademarks of Apple Inc. Additional company and product names may be trademarks or registered trademarks and are hereby acknowledged.

Custom Search

Amazon.com

Navigation

Used Mac Dealers
Apple History
Video Cards
Email Lists

Favorite Sites

MacSurfer
MacMinute
MacInTouch
MyAppleMenu
InfoMac
Macs Only!
The Mac Observer
Accelerate Your Mac
RetroMacCast
PB Central
MacWindows
The Vintage Mac
   Museum
DealMac
DealsOnTheWeb
Mac2Sell
ramseeker
Mac Driver Museum
JAG's House
System 6 Heaven
System 7 Today
the pickle's Low-End
   Mac FAQ
Abandonware
   Petition
Mac vs. PC Info

Affiliates

The Apple Store
Mac Connection
B&H
MacMall
TechRestore
ExperCom
Crucial Memory
batteries.com

Advertise

All of our advertising is handled by BackBeat Media. For price quotes and advertising information, please contact at BackBeat Media (646-546-5194). This number is for advertising only.

Open Link

Problems viewing this page with Internet Explorer 5.5 or 6? It works fine in other browsers, including IE 7. We recommend Firefox for those using Windows, as it is standards based and more secure than IE 6 (and earlier). More LEM visitors use Firefox than any other browser.