Unauthorized purchase and no email trace of unauthorized connection and new addresses

[WalterI]

Hello,

I have been using Paypal for years and tonight I had a very unpleasant surprise.

I got an SMS from my credit card company indicating a purchase, via Paypal, which I did not do.

I logged in immediately on my Paypal account and found 2 shipping addresses which are not mine (in a different region completely: I live in Spain and we're talking about 600Km away.

I have no indication that anyone has logged in as me, nor I got an email from Paypal about the purchase.

Yet, my Paypal account is OK: the email address is mine and has not been changed. The Password was not changed (I changed it now, just in case - and I have 2-factor authentication, and I got regular emails, as expected), so I don't understand how this could have happened.

I claimed the purchase immediately, but Paypal has already rejected the claim with almost no explanation ("After our review, we found that certain transactions weren't unauthorized and hence couldn't be covered by PayPal Purchase Protection."): if they were not authorized, why I don't have protection?

But my main question is: how were they made to begin with? How could somebody use my Paypal account, without me receiving any email notification of a new login? (even assuming that my password was hacked, somehow)
And if somebody changed the corresponding email address (for example, to do so temporarily and avoid me getting the notifications), how could I not get any email about a change in email address?
This makes no sense to me, and yet, the order was made, and it was for a huge amount of money, so, it's not a joke.

Has anyone else had a similar issue?

Walter

[sharpiemarker]

@WalterI 

("After our review, we found that certain transactions weren't unauthorized and hence couldn't be covered by PayPal Purchase Protection."): if they were not authorized, why I don't have protection?

You misread the decision. PayPal said that “certain transactions weren’t unauthorized”. They didn’t find it as unauthorized and that’s why you couldn’t be covered. I guess the point of being a hacker is to do it undetected as much as possible. Contact customer services again and ask them to do a deeper investigation by a human.

https://www.paypal.com/es/smarthelp/contact-us      

Click “Message Us” or “Call Us” option on the bottom.   

Or reach out to PayPal at Facebook or Twitter:    

PayPal on Facebook

PayPal on Twitter

[tonybuk86]

I had the same thing happen to me today, someone used my paypal to buy something from game, I dont even have a game account, and I'm at work as I work nights, why cant we get a notification when someone new logs into my account with a new device? you notify us about a payment why not that?

[WalterI]

@tonybuk86 , I do get email notifications when I log into from a new PC, or when I purchase something.

In this case I got no email (just an SMS, but from my credit card company, not Paypal).
If my Paypal account had been hacked the email would have changed, but it did not and I could log into it without issues.
Even if somebody hacked into my PC (which was offline at that time) and remotely used it to purchase his stuff, I should have gotten confirmation emails (just 3 days ago I purchased something with Paypal, and I have the usual confirmation emails and receipts).

So this seems to be a hacking of Paypal itself.

[WalterI]

Thank you for your help.
I will contact them (I see it is available Monday-through-Friday).

Do you have any idea how could something like this happen?

There seems to be many cases similar reported on this community, and I have read quite a few, but there's never been a clear solution or a clearly identified root cause.

[1977David]

I live in North Carolina in the US.  I received a notice from my bank that my checking account was overdrawn in the amount of roughly 4500.00.  The charge was coming through PayPal.  I went to my PayPal account and discovered that someone in Vietnam had done 2 transactions.  One was for 5.00 and then one was for 4985.00.  I also noticed my email address had been changed as well as my phone numbers hence I did not receive any notice of this.  My bank rejected this as fraud but PayPal has said it is authorized use and I am on the hook for this money.   It seems like this is happening over and over and the frequent thing I hear is PayPal labels them as authorized use and refuses to reimburse.  Their system is obviously getting hacked and they are not doing anything about it or simply don't care.  What is clear is they are not abiding by their pledge of zero liability.  I have read that if I don't pay this negative balance they will turn over to collections which will ruin my credit.  What can I do? 

[WalterI]

Hello @1977David ,

What helped me is contacting the store where the illegal purchase was done and ask them to cancel the order.
I was lucky that they did, and refunded me. 
The funds are now in my Paypal account and I am waiting for it to be charged back to my card.

In my case, there's much unknown: the email associated to my Paypal account was not changed, but I did not get any notification about new addresses being added, nor there's any trace of the illegal purchases in my inbox (but the illegal activities are in my Paypal logs). I don't understand how this can have occurred, nor how Paypal cannot see that there's something wrong (they must have records of the emails sent and they could cross-check with the activity in my account).

Anyway, I hope contacting the store will help you recovering your money.
The suggestion from @sharpiemarker is also worthwhile: go to the support center and ask for a detailed/manual review of the illegal activities. (see the post above)

Good luck!