A transaction took place on PP which was not authorized by the account holder. SMS authentication was enabled. PP are saying that the transaction 'wasn't unauthorized' so won't do anything to investigate. I'm not interested in PP's response to the incident but how does someone bypass the SMS authentication to set up the transaction in the first place?
