Cybersecurity analysts at CyberNews have uncovered an ongoing scam using loopholes in PayPal and Facebook.
Fraudsters are stealing roughly $1.6 million per month by convincing Facebook users to voluntarily send money.
CyberNews talked with hackers inside the blackhat hacking community to discover the steps they take to make this complex scheme work.
In simple terms, it works like this:
-
A hacker logs into someone’s Facebook or Messenger account and starts sending messages to the account holder’s friends. (Usually, they claim that they sold something online but are having problems with their PayPal accounts.)
-
The hacker asks these friends if they’d receive money in their PayPal accounts and send the same amount to the hacker’s bank account.
-
When the friend receives the money in their PayPal, they send the money via bank transfer to the hacker’s account.
-
The hacker uses PayPal’s chargeback feature which reverses the money sent to the friend in the first place, and the friend loses out on that money.
Numbers-wise, it would look like this:
-
Hacker sends the target $400 via PayPal. The target now has a $400 surplus.
-
The target sends $400 via bank transfer to the hacker’s bank account. The target now has zero balance (they didn’t lose or gain any money).
-
The hacker does a chargeback, and the money is removed from the target’s PayPal account.
-
The target has now lost $400.
The blackhat hacking community told CyberNews that they use simple loopholes found in Facebook, PayPal, and the banks themselves.
CyberNews previously uncovered six critical vulnerabilities in PayPal’s payment system, which allow for hackers to easily access those accounts, and PayPal still hasn’t fixed some of them.
The scammers are mainly from the US, UK and Russia, and at the moment mainly targeting UK Facebook users.
The UK is targeted specifically because PayPal is the country’s second most popular payment method and it is relatively easy to create a bank drop (when bank accounts are hijacked to transfer stolen money) there.
When CyberNews contacted PayPal, the company responded: “We never lose sight of the fact that we are entrusted to look after people’s money. We take this responsibility very seriously and use advanced fraud and risk management tools to keep our customers and their payments safe.”
They further warned their customers: “Always question uninvited approaches in case it’s a scam, and check directly with the person concerned to verify the request. And never accept or move money on behalf of someone else.”
