Network Security
Vulnerability Management
Privileged Access Management
Endpoint Security
Threat Hunting
Unified Endpoint Management
Email & Collaboration Security
Contents:
Is PayPal safe? Well, taking into account that PayPal’s one of the oldest and most ‘seasoned’ online money transfer platforms, it’s safe to assume that many an effort have been made to bolster its security.
Of course, timeline-wise, it was a trial-and-error kind of gig but at the moment, PayPal’s right out there with the big players such as Revolut, Dwolla, TransferWise, Payoneer, and Google Pay. So, what does that tell us in terms of cybersecurity? With that being the question du jour, let’s dig in and find an answer to our “chicken-or-the-egg” question: is PayPal safe or not?
Before we dwelve into it, if you are concerned about PayPal account’s security, here are 11+ scams you should look out for. Right, now onto the breach!
Is PayPal Safe for Your Cybersecurity?
In a nutshell, I would have to venture to say that PayPal is not completely safe. Of course, the same thing can be said about any online money transfer platform, but keep in mind that being the eldest player, it obviously attracts a lot of unwanted attention. And with some 227 million account holders worldwide, figuring out who’s next in line to be swindled is like playing charades.
According to the company, online fraud incidence is holding at a steady two percent, which is pretty decent considering that PayPal alone processes $235 billion in payments per year, and has ties to no less than 17 million websites and organizations.
Considering these numbers, we can assume that the peer-to-peer payment platform is not short of fraud attempts. So, what are the main risks of opening up a PayPal account or holding on tight to the one you have? Here’s a rundown of the most common types of swindling attempts.
1. Phishing
Phishing’s probably the most ‘abused’ and quite successful online scam (makes you wonder if PayPal is safe or not). Why is that, you ask? I wouldn’t pin it on the account holder’s gullibility; more on the fact that no one’s willing to spend ten minutes of their time reviewing PayPal’s Buyer and Seller Protection policy.
In the aforementioned article, I pointed out that most users are not aware of simple, down-to-earth PayPal facts (i.e. the platform will never request private info like address, password, financial details, or your social security number via email).
If your inbox lights up and you see an email from ‘PayPal’ requesting those details, then it’s more than likely a fraud attempt. PayPal phishing comes in many guises: some will ask you to follow a link in order to review and update your financial info, others try to reel you in with the promises of free cash or out-this-world prizes, while some are nicely wrapped in a sad story that tugs on your heartstrings (i.e. fake charities).
Be careful around emails containing attachments. Official PayPal emails don’t have any, apart from the company’s header.
2. Smishing
Email phishing’s not the only dirty trick in the scamming book. Phishing via text messages or smishing, is a quick way of finding out if you have a PayPal account.
In most cases, these ‘reverse-engineered’ text messages contain phone numbers. Yes, they entice you into calling them back to confirm a couple of ‘harmless’ details. Of course, they could also pack links to fake credential-grabbing sources, masquerading as legit PayPal pages. So, how this scam work? Here a quick heads-up:
- You receive an SMS that reads: “Your PayPal account has been suspended due to suspicious activity. Please contact us immediately at <fraudster’s phone number>. It is imperative that we speak to you immediately.”
- Another version “PayPal: You spent <random amount> with PayPal. If you did not make this transaction, please call us immediately at <scammer’s disposable phone number>. Thank You.”
- Here’s a version that contains both phone numbers and phishing links: “PayPal: You spent <cash amount of choice> with PayPal. If you did not make this transaction, please login at mobileservices2019.com/txn?id=178948 to revert this transaction. Thank You.”
What happens if you call that number? Well, I guess you’ll have a ‘lovely’ chat with the fraudster who will probably try his best to persuade you into disclosing your account’s details. As for the link, I think we both know how this story ends (with you asking if PayPal is safe or not, of course).
3. Vishing
If phishing and smishing don’t work, we will always have vishing. What’s vishing? It’s a phishing method that involves an automated system designed to make voice calls. So, how does this work? Well, according to PayPal’s fraudulent pages and websites section, you may be called by someone claiming to be a company representative, urging you to either confirm or submit some credentials.
The conversation can go something like this:
This is PayPal calling about a possible fraudulent transaction on your account. Please enter your password now to hear the transaction details. We need your immediate response to block or confirm this transaction.
Guess what happens after submitting the password? Yes, it’s bye-bye PayPal money. Even more daunting is the fact that the scheme’s so perfect, that you will keep on thinking that the call was actually PayPal. Before calling, the scammer can change the caller ID to read “PayPal” or something similar. You still wondering if PayPal is safe?
4. Banking Trojans
And because phishing was not enough, now we even have trojans capable of ‘siphoning’ money from your account. This malware variant called a “banking trojan”, can bleed your balance dry even with two-factor authentication.
Cybersecurity researchers revealed that this trojan comes in the guise of a system and battery optimization app called Optimize Android. Upon installation, the app asks the user to switch on the “Enable statistics” option. After that, the trojan will begin analyzing your smartphone’s external and internal storages for banking apps like PayPal. If detected, the malware will wait for the user to enter his credentials before stealing money via the fake click method.
What sort of security measures does PayPal have in place?
Source: Make Tech Easier
To ensure that your hard-earned money stays where it’s supposed to, PayPal employs three types of security measures: email confirmations, PayPal Security Keys, and data encryption. There’s even a fourth measure, but it’s still being tested. Asking yourself if PayPal is safe or not?
1. Email confirmation
Each time you receive\issue a payment, you will be notified via email. Of course, if you receive this payment without performing any action in particular, you should definitely think about contacting PayPal since it’s obvious that someone might be trying to ‘hotwire’ your account.
2. PayPal Security Keys
This is PayPal’s take on 2FA. When switched on, the app will ask you to enter a security code, in addition to your PayPal password. Check your smartphone’s SMS inbox for the code; the security keys service is free of charge, but messaging rates may apply. Check with your mobile provider for additional details.
3. Data encryption
Since all transactions are online-exclusive, there will be a lot of safeguards in place: TLS protocols, Key pinning, and GDP (general data protection). When logging in, PayPal’s platform will determine if your connection’s TLS 1.0 or higher.
Of course, for extra protection, you should ensure that your browser’ capable of handling HTTPS connections (look for the padlock icon next to address bar).
To counter comm-interception attacks, PayPal uses a security layer called Key Pinning. This safeguard ensures that your browser’s communicating with a legit PayPal server. Why would this be useful? Well, scammers can actually intercept data in transit and redirect you to a cloned website. Key pinning prevents such attacks.
Last, but not least, PayPal’s data protection policies for both data-in-transit and at-rest are industry-compliant. This includes PCI-DSS and deference with independent third parties like the American Institute of Certified Public Accountants SSAE16 SOC1, Sarbanes-Oxley Act, and AT101 SOC2.
4. PayPal 3D-Secure (3DS Protocol)
As part of its ongoing anti-fraud crusade, PayPal has added an extra security layer which draws upon EMV’s proprietary 3-D Secure Protocol. Fully compliant with SCA (Strong Customer Authentication), this added layer will require the account holder to transmit a special security code to the bank that issued his credit or debit card in order to complete a transaction.
Depending on your card type, the system’s called “Verified by Visa”, “SafeKey”, or “MasterCard SecureCode”. Keep in mind that not all banking apps are compatible with 3-D encryption. The protocol will not be enabled by default.
Good news is that you will be able to ditch it if you have a hard time completing a transaction. Please note that the 3D-Secure passkey’s different from your PayPal’s password. Yes, it means that you’ll need to enter both in order to complete a transaction.
How to beef up your PayPal account security
Source: YouTube
Undoubtedly, there will always be someone out there just waiting to bleed your PayPal account dry. Though no one can guarantee complete safety (there’s no such thing in the online world), there are a few things you can try out in order to boost your security. So, without a due, here are some actionable security tips you should follow if you plan on keeping your PayPal account.
For Buyers
#1. Avoid transactioning over public Wi-Fis.
Keep in mind that unsecured Wi-Fis are great ‘hunting grounds’ for scammers. If the transaction cannot wait, you should consider using your mobile data instead of an open Wi-Fi. Charges may apply, but at least you would have answered the “is PayPal safe?” question.
#2. Using a dedicated device vs. an all-purpose device.
I know that the very thought of using a dedicated device just to view balance may seem like a whim, but it’s actually a lot safer than using an all-purpose machine (i.e. home PC or smartphone). How will this work? Let’s say you have a laptop at home, sitting idly in the corner, and collecting dust.
Instead of letting it die out, you can repurpose it to suit your PayPal needs- use this endpoint to make PayPal transactions, while keeping your smartphone and/or home computer for personal stuff (i.e. online gaming, surfing on the web, social media).
If you use a dedicated machine for PayPal activities, you won’t have to worry about having to deal with spyware or malware picked up from the web because you just had to see that cat video!
#3. Don’t link a debit card to your PayPal account.
I really don’t think it’s a good idea to hook up your debit card to any kind of online account, regardless if it’s Netflix, Google Play, or PayPal.
Now, with a credit card, worst case scenario would be covering for the ‘siphoned’ money (well, it’s not really what I would call an improvement, but you’ll still be able to make due until the next paycheck).
There’s another advantage to linking your credit instead of a debit card: if PayPal refuses to refund your money, you may still be able to settle the matter with the bank that issued your credit card in the first place.
#4. Keep an eye out on your balance
While it’s always a good idea to keep tabs on your PayPal balance, you should turn it into a habit from now on since scammers are known to trickle small amounts from your account. There’s even a short and sweet story to back up that claim. Anissa Wardell of The Publicists Assistant, says that after checking her account, she noticed that small sums kept vanishing (some $5 to $10 every couple of days).
Upon contacting PayPal, she was informed that the money was going to some small UK-based grocery store. Imagine her surprise when she found out that she’s been berry-picking without even being aware that she was doing it. Fortunately, the account was closed in time.
And because all’s well when it ends well, PayPal even offered her a full refund. There’s a lesson to be learned here – if you see that you’re a couple of bucks short, do yourself a favor and contact PayPal on the double. Sure, a few dollars every odd day isn’t a big deal, but imagine what can happen in a couple of weeks if the issue goes unresolved.
#5. Don’t click on in-mail links from ‘PayPal’
Spoofing’s not what you might call a cutting-edge scamming technique. Still, as the saying goes: “if it’s stupid, but it works, then it’s not stupid.” Now, if you come across any PayPal links in emails, hover your mouse over them; chances are that they have nothing to do with PayPal. There’s a surefire way to find out if the email is really from PayPal – hop on your account and go to Notifications. If PayPal wanted to reach out, then there will most certainly be an unread notification.
#6. Buy from trusted sources only
This one’s pretty straightforward– look for the padlock icon next to the merchant’s URL or Google’s checkmark; this is, by far, the fastest way to figure out if the vendor’s legit or someone trying to steal your money.
#7. Get yourself checked out
Trust goes both ways; even more so when money’s involved. As a buyer, you can verify your account by linking it to a valid email address or phone number. There are other, more ‘unsecure’ ways to verify your identity – by supplying your social security number or by attaching a debit\credit card to your account.
A bit of a paradox here, if you ask me; sure, typing in your SSN makes you a real person, but also puts your PayPal in harm’s way. A few bucks missing from your bank account is sad, but imagine what happens in case someone steals your identity. Now, if you opt for the SSN\debit & credit card verifications, I would strongly advise you to keep a close watch on your account and report any suspicious activity.
#8. Use third-party access token software with PayPal Developer
Though it’s a bit tricky, ‘cause it involves messing around with code lines and open-source apps, you will be able to add an access token to your PayPal account through the Developer medium. If you feel up to the task, follow the steps below to make the app generate an access token.
Step 1. Go to PayPal Developer and log in using your credentials.
Step 2. Head to the My Apps & Credentials section.
Step 3. Under the REST API section, click on Create App.
Step 4. Type in a name for your new app and hit the Create App button.
Step 5. Edit and review the app’s details, if necessary and then hit the Save button.
Step 6. To generate the access token, make a token request using the application’s OAuth client id and, of course, the secret keys using the /token command. This will give you the basic authentication values.
Step 7. Look the request body and change the grant_type line to client_credentials.
Step 8. Review your code lines and hit the run button. If written correctly, the app should give you an access token.
Yes, I know that this sounds like Medieval Klingon, but let me give you a hand. Here’s how the access token request should look like:
curl -v https://api.sandbox.paypal.com/v1.oauth2/token \ H “Accept: application/json” \ H “Accept -Language: en_US” \ -u “EO EOJ2S-Z60oN_le_KS1d75wsZ6y0SFdVsY9183IvxFyZp:EC1usMEUk8e9ihI7ZdXLF5cz6y0SFdVsY9183IvxFyZp” d “grant_type=client_credentials”
For sellers
#1. Don’t oversell your goods
I know that the urge to boast your goods is strong, but you should definitely refrain from being too “flamboyant” in your description. Stick to the basics: size, weight, and condition – anything the buyer needs to know about the product he’s about to purchase. If you’re selling used goods, you should also consider adding notes about any scratches or marks.
Why this nitpicking? Because it’s a common PayPal scamming technique to open disputes over products not matching their descriptions. And yes, it doesn’t matter how insignificant the differences are; they’ll still try to dispute it. To avoid this embarrassing situation, post lots of close-up pictures and consider adding a follow-up note to ensure that the package arrived on time and everything’s hunky-dory.
#2. Only agree to ship to confirmed addresses
PayPal wholeheartedly encourages the seller to ship only to buyers who have confirmed their shipping address. Before completing the transaction, ensure that the person verified his credit card and that the billing will be done to the same address. Consider adding tracking to your shipment.
#3. Avoid using labels that are emailed or sent to you
Always use your shipping company’s labels or wrappings. If someone asks you to stick a different label or postage mark on the package, it’s a high chance that you may be dealing with a scammer. So, avoid shipping through major postal services, using labels received at home or over email, and use online tracking. Now, if your goods exceed $250, request a signature on delivery.
#4. Watch out for suspicious transactions
In some cases, especially when high-value items are involved, the scammers will attempt to rush the shipment or to make partial payments through several PayPal accounts. Always ask for full payment from a single, trackable, and registered PayPal account, and don’t forget about signature confirmation on receival.
#5. Don’t misplace your sale and shipment records
Keep in mind that PayPal buyers are legally entitled to dispute any transaction within 180 days. Still, that’s not the end of the line; to qualify for the company’s seller protection program, keep all the records pertaining to sale and shipping. Moreover, you’ll be more likely to outwit a potential scammer if you send out the requested documentation and for quick responses to disputes.
PayPal Security FAQ
Q: Is PayPal safe to keep money?
A: As long as you take the necessary precautions, there’s no reason to worry about money deposited in your PayPal account. If you have any reasons to believe that your PayPal’s account might be at risk, contact PayPal support.
Bear in mind that PayPal does not replace a regular bank account, so you should refrain from keeping all your money tied in your online account.
Q: Is PayPal safe to use with bank account?
A: The platform allows account holders to tie in their bank accounts, by attaching a credit or debit card. To bolster your security, I would advise against linking a debit card to your PayPal account. In the event that a scammer breaks into your account, fraudulent credit card charges can easily be cleared with the issuing bank. However, if the scammer manages to empty your debit card, then there’s nothing more to be done.
Q: Is PayPal safe to transfer money?
A: PayPal is one of the safest money transfer environments. Make sure that you carefully read the terms and conditions that apply to your case (buyer or seller).
Q: Is PayPal safe to buy online?
A: As long as you make your purchases from legitimate vendors, the chances of being scammed are negligible. If you have any reason to doubt the seller’s intentions, contact PayPal for a quick check-up. In the meantime, you can search for signs of frauds yourself.
Look for things like billing address doesn’t match the shipping one, the vendor wants to use postal services instead of relying on a shipping company. If the seller has an e-shop or a presentation website, you can also check the content for any discrepancies (i.e. stock photos, spelling errors, texts on how to get rich fast, over-inflated user comments, spammy articles).
Wrap-up
So, is PayPal safe? Long story short: yes, it is or, at the very least, it’s safer compared to other online-money transfer services. Of course, no one can guarantee that nothing bad will happen to you when using PayPal.
It’s safe to assume that it all boils down to what we do in the ‘shadows’, I guess: if you’re careful enough about your account’s cybersecurity, then the only way someone’s going to steal your money would be to rob you at gunpoint. Lessons learned? Avoid shady vendors, put several security layers between you and the scammer, report suspicious activity, and don’t go overboard with the selling bit. Do you have any sad or amusing PayPal stories to share with the rest of the community? Don’t be a stranger and leave a comment.
