Scammy/malicious accounts

NickDanger
Contributor
Contributor

I've identified (at least) two scams that are collecting payment via Paypal, using the accounts <removed> and <removed> - the checkout pages containing that information can be found here:

 

http://helloindia.com.au/domain/pay.php?domain=paypal.com&name=Fake+Name&email=invalid%40account.com...

 

http://harshproperties.com/domain/pay.php?domain=paypal.com&name=Fake+Name&email=invalid%40account.c...

 

http://brisbanehomeopathicclinic.com.au/domain/pay.php?domain=paypal.com&name=Fake+Name&email=invali...

 

In a nutshell:

  • Those pages are being advertised via spam EMails that hawk worthless "SEO registration" services
  • It appears that the same identical payment pages are located on multiple sites/different domain names
  • It also appears that the scammers are using hacked sites to host their payment pages, as the content of the sites appear to have nothing to do with "SEO registration" - one is a homeopathic clinic, one appears to be a real estate site, and another appears to be a travel/tourism specific to India

Is there a process for reporting malicious/fraudulent use of Paypal directly? I looked, but all I could find were instructions for reporting attempts to spoof Paypal/phish Paypal accounts, and I couldn't find any info on reporting abuse/mis-use of Paypal's services.

Login to Me Too
8 REPLIES 8

NickDanger
Contributor
Contributor

Hello....? Anyone...?

 

It's been 5+ days, yet it appears that nothing WHATSOEVER has been done to address this - given that ALL three of the scam accounts I reported are still active.

 

Is there ANY intention to actually address this? Or should we start seeking media coverage instead? I'm guessing that people like Brian Krebs, and other journalists who specialize the topic, would be interested to hear about Paypal's failure to address the use of their services to collect payment for scams.

Login to Me Too

NickDanger
Contributor
Contributor

So you edited the original to remove the scam account names <removed> and <removed>, but have failed to do anything about the actual issue (given that both accounts are still active & the scam checkout pages are still functional)...? Should I interpret that to mean that the use of your services to collect payment for scams is not a concern to Paypal?

 

For what it's worth - just discovered yet another one: also using a hacked site, and the <removed> account:

 

http://sparklesrus.com.au/domain/pay.php?domain=paypal.com&name=Fake+Name&email=invalid%40account.co...

 

 

Login to Me Too

NickDanger
Contributor
Contributor

Two more, one using the <removed> account:

 

http://islamenaab.org/domain/pay.php?domain=fakedomain.com&name=Fake+Name&email=invalid%40account.co...

 

And one using the <removed> account:

 

http://withvogue.com.au/domain/pay.php?domain=fakedomain.com&name=Fake+Name&email=invalid%40account....

 

I was initially surprised that to see that those scammers were putting their accounts addresses in the clear, rather than using encrypted checkout code - but after witnessing Paypal do nothing about issue despite being aware of it for nearly 10 days, I now see why the scammers didn't feel any need the accounts they're using.

 

I think I'm going to start seeking media coverage for this issue, given Paypal's ongoing & evidently total failure to do anything about these scam accounts.

Login to Me Too

PayPal_Olivia
Moderator
Moderator

Hi @NickDanger,

 

Thank you for your post. I'm sorry that the posts had to be edited to remove the email addresses posted, but this forum does not allow the posting of any email addresses or other contact information. This type of report cannot be received via the community forum.

 

There are a couple of options for reporting violating accounts.

 

If you believe an account has violated the Acceptable Use Policy, there is an email address at the bottom of the policy's page that can be contacted. To reach the Acceptable Use Policy, please click Legal at the bottom of any PayPal page.

 

If you believe that an account is behaving fraudulently, you can contact customer support to allow a representative to begin an investigation into the account. You can reach customer support by Facebook, Twitter, or phone or email.

 

Thank you again for your concern in keeping PayPal a safe payment environment!

 

Olivia

 

If this post or any other was helpful, please enrich the Community by giving kudos to its author, accepting it as a solution, and/or coming back to assist others. Members make this Community great!
Login to Me Too

NickDanger
Contributor
Contributor

Re: "I'm sorry that the posts had to be edited to remove the email addresses posted, but this forum does not allow the posting of any email addresses or other contact information. This type of report cannot be received via the community forum."

 

Oh don't worry, I made sure to save screenshots & a PDF of the thread beforehand - and anyone else can easily find that same information by viewing the source of any of the links I posted & searching for "&business=".

 

Also interesting to note that the actual issue still hasn't been addressed - certainly gives a strong impression that Paypal is more concerned with your forum rules, than the use of your services to scam people. And also interesting that the better part of 8 days went by with no response (aside from a stealth-edit to the original post), but then I finally get a response within a few hours of tweeting @AskPayPal about it.

 

Re: "If you believe an account has violated the Acceptable Use Policy, there is an email address at the bottom of the policy's page that can be contacted. To reach the Acceptable Use Policy, please click Legal at the bottom of any PayPal page."

 

Nope, not when I view that page here - specifically, https://www.paypal.com/ca/webapps/mpp/ua/legalhub-full?locale.x=en_US (since you didn't post a link to it). A "find in page" for the text "@" and "mail" returns no results. I'd ask you to post the address, but wouldn't want you violate your own forum policies...

 

Re: "If you believe that an account is behaving fraudulently, you can contact customer support to allow a representative to begin an investigation into the account. You can reach customer support by Facebook, Twitter, or phone or email."

 

Yeah, sounds like it's probably best to discuss this through Twitter instead - given this thread seems to have been ignored until I posted about it there. I had assumed you would prefer to resolve this matter in a less-public forum, but it's certainly fine by me if not.

Login to Me Too

PayPal_Olivia
Moderator
Moderator

Hi @NickDanger,

 

I'm sorry for any confusion. The Acceptable Use Policy is found by clicking Legal and then clicking on the link that is found there that says PayPal Acceptable Use Policy. On that page, the policy itself can be found, and if there are violations thereof, they can be reported to the link at the bottom of the page. 

 

However, in this situation, the type of activity that you describe is better suited to being reported to customer support, since it is fraudulent activity. I'm glad to hear that you reached out on Twitter.

 

I'm sorry that you encountered frustration while trying to make a report. 

 

Olivia

 

If this post or any other was helpful, please enrich the Community by giving kudos to its author, accepting it as a solution, and/or coming back to assist others. Members make this Community great!
Login to Me Too

NickDanger
Contributor
Contributor

Almost EIGHT months later, and both accounts that I reported are STILL active, and STILL actively being used to scam people. Your failure to do ANYTHING about the issue in that amount of time gives a very strong impression that Paypal is deliberately turning a blind eye, knowingly allowing the use of your service to process payments for a blatant scam - while you also coincidentally profiting from said scam, by way of transaction fees.

It certainly doesn't help that impression much when nearly every response I've had from Paypal has attempted to pass the buck & get me to jump through hoops to spoon-feed you easily available information, so you can fix an issue that you are responsible (at least in theory, since you've failed to actually address it). On that topic, is there any valid reason why Paypal support staff often reference pages on the Paypal website, but then consistently fail to provide actual links to them? That's been the case with nearly every response I've had from Paypal on this issue? That just makes it look even more like you're deliberately giving me the run-around.

That said, I've decided not to waste anymore of my own time on this. Instead, I've provided all of the information that I've collected about this matter to Brian Krebs, an independent journalist who is well-known for writing about tech security and online scams - since, as it just so happens, he's recently published an article about this exact scam, and is preparing a follow-up. So you might want to let your media relations people (that is, if Paypal isn't too cheap to have any on staff) know that they should expect to hear from him - I'm honestly quite curious to see if you give a journalist read by millions the same run-around. Partly for the entertainment value, and partly because it would fairly definitively establish whether the run-around you've given me was deliberate, or merely ineptitude.

Last, as a professional web developer & business owner who has used Paypal on numerous sites over the last 15 years (as well as to receive payments from our own customers), this experience does NOT inspire confidence - and that's putting very mildly. I run a business, and seeing how Paypal handles (or doesn't) these types of issues has raised serious concerns about the risk of having my business associated with a company that knowingly allows the use of their services to scam people... not that your reputation was that great to begin with, frankly, I've had multiple responses over the years from customers saying things like "Oooooh, you use Paypal? Nevermind, I'll just send a cheque by mail instead." To be honest, I've been meaning to try out your competitors for a while now, but this experience just gave me a final push - and in the process, I've discovered that their systems are substantially easier to work. So, thanks, I guess?. Perhaps Stripe, Square, Moneris, etc, should be paying a commission to Paypal support, because if nothing else, you've done a fantastic job of promoting their services!

 

P.S.

Since you keep removing them, here are the offending accounts once more: exaltka_AT_gmail.com, info_AT_internetbirodalom.hu

Login to Me Too

Haven't Found your Answer?

It happens. Hit the "Login to Ask the community" button to create a question for the PayPal community.