Advice Please Possible Paypal Fraud

[twotone]

Hi guys, my daughter's Paypal account appears to have been used fraudulently with an unauthorised purchase of £355 to buy, of all things, a Sonos Connect wireless music system from John Lewis.

The purchase was made on 2nd July at about 5pm and my daughter received an email from PayPal re the purchase around the same time.

There's a Paypal transaction no and the purchase appears to be genuine however the first name of the purchaser is obviously different from my daughter's first name but the surname is the same and our address is listed as the delivery address.

There's no one with that name living here and never has been and we don't know anyone with that name, my surname isn't a common surname either.

My daughter contacted Paypal and opened an unauthorised activity case which was then closed by Paypal so she had to call Paypal customer services who re-opened the case but I think they have closed it again and she can't close her account or remove associated debit cards linked to the account, paypal's website (her account) just say's transaction pending when she tries to remove a card or an linked account.

She's also contacted John Lewis who have said that they'll look into the purchase however there was only the transaction number available but no order number so that might make John Lewis's search a a wee bit more difficult and she's also contacted her bank (M&S) who have said that they'll start an investigation and have passed the case onto their fraud department and of course she has another bank account linked to her Paypal account which is the back up payment in the event that the primary account doesn't have sufficient funds but she's reluctant to close that account as it's her main account for paying DDs and wages etc but she's going to contact them this morning.

I'm concerned that our internet connection has been compromised because PayPal are saying that the IP address and mac address of her iPhone/Macbook were used to to make the purchase which is why they've said the purchase was authorised but up until now no one else in the house has been affected as far as we know.

My daughter mainly uses her iPhone to access the various accounts that she has including her PayPal account so I don't think that the house internet has been compromised but who knows?

I have a Draytek Vigor 2862 router with all of the settings default more or less and the firewall is definitely switched on.

The other thing that bothers me with this is how can whoever has made this purchase expect to benefit from this purchase because the Sonos has to be sent to our address so how can they make John Lewis refund them the £355? And even if John Lewis issues a refund then they'll surely refund my daughter's PayPal account, no?

Just doesn't make sense to me which is why I'm think that this is a genuine error but obviously we are pretty concerned at this situation.

Anyway apologies for the length of this post but if anyone can explain how this potential fraud works or can offer advice I'd be very grateful.

Below are the emails from Paypal.

Thanks

Tony


Hello Elizabeth ************,

Jul 2, 2019 18:55:17 BST
Transaction ID: O-0GX652492S951324

You submitted an order in the amount of £355.95 GBP to John Lewis PLC.

Thanks for using PayPal. Please note that this is not a charge. Your account will be charged when the merchant processes your payment. You may receive multiple emails as the merchant processes your order.
Your funds will be transferred when the merchant processes your payment. Any money in your PayPal account at that time will be used before any other payment source.
To see the full transaction details, log in to your PayPal account.
Merchant
John Lewis PLC
[email protected]
Instructions to merchant
You haven't entered any instructions.
Delivery address
Lucas **********
69 M**** *****
C*********
G*******
G*******
United Kingdom
Dispatch details
The seller hasn’t provided any dispatch details yet.


Description Unit price Qty Amount
Sonos Connect Wireless Music System
Item Number 82370104 £349.00 GBP 1 £349.00 GBP
Delivery
£6.95 GBP 1 £6.95 GBP
Subtotal £355.95 GBP
Total £355.95 GBP
Payment sent to [email protected]

Issues with this transaction?
You have 180 days from the date of the transaction to open a dispute in the Resolution Center.

Questions? Go to the Help Center at www.paypal.com/uk/help.

We've completed our review of your unauthorised activity case, and we’ve determined there was no unauthorised use.

You've previously appealed this case but it was denied. The appealed case ID is PP-I-5848243.
For more information about these cases, log in to your PayPal account and go to the Resolution Centre.

Yours sincerely,

PayPal



Dear Elizabeth C*********,

We received the claim(s) you opened on 2 July 2019.

We've reviewed the transaction(s) and are denying your claim(s). This decision was made because this transaction was not unauthorised.

We're sorry for any problems you may have experienced with the transaction(s).

Learn More about PayPal Purchase Protection

Find out how your purchases are protected and how we investigate claims by clicking Security at the bottom of any PayPal page.

Transaction information:

Dispute Case ID: PP-D-34713732

Transaction Amount: £355.95 GBP

Dispute Amount: £355.95 GBP

Transaction ID: 2HS01675V18247352

Transaction Date: 2 July 2019



Yours sincerely,

PayPal

 

[TheDecameron]

One way out is- send the item back for a refund under distance selling regulations. Then make security changes to accounts.

 

[twotone]

One way out is- send the item back for a refund under distance selling regulations. Then make security changes to accounts.

Thanks Dec, yes I've said that to her, do you think this is a genuine error by either JL or Paypal cause I can't think of any way a scammer can benefit from this?

 

[TheDecameron]

Thanks Dec, yes I've said that to her, do you think this is a genuine error by either JL or Paypal cause I can't think of any way a scammer can benefit from this?

It’s a really odd one. My first reaction was- does your daughter have a mischievous younger sibling or friend?

 

[twotone]

It’s a really odd one. My first reaction was- does your daughter have a mischievous younger sibling or friend?

No no-one like that here Dec, she's 31 and a doctor and my son is 30 his name is John and there's no way he'd do something like that anyway.

Apparently Paypal told my daughter that the IP address used to make the purchase is one that she's used previously so going by that I'd say it's her iPhone that has been compromised or there's a problem with Paypal's systems.

 

[Fatmarley]

Could it have been done by accident?

Someone Private Messaged me once asking what I was on about. I think the cat must have walked around on my pc keyboard and somehow managed to write a message and send it.

 

[twotone]

Pos

Could it have been done by accident?

Someone Private Messaged me once asking what I was on about. I think the cat must have walked around on my pc keyboard and somehow managed to write a message and send it.

Possible but I doubt it, if someone here has bought it they would have to know the login details for the PayPal account and be here to accept delivery and if someone has managed to clone the IP address then how can they possibly manage to take delivery without us knowing it’s been delivered?

 

[awkwardbydesign]

she can't close her account or remove associated debit cards linked to the account, paypal's website (her account) just say's transaction pending when she tries to remove a card or an linked account.

One way to remove the credit cards would be to tell the bank they have been stolen. They will send new ones in a few days. I did this with an Italian car hire company who were charging me 50 euros to notify me of driving offences! Which were not valid as we have a disabled badge. And there were 4 of them!

 

[sp25]

Pos


Possible but I doubt it, if someone here has bought it they would have to know the login details for the PayPal account and be here to accept delivery and if someone has managed to clone the IP address then how can they possibly manage to take delivery without us knowing it’s been delivered?

Make sure that John Lewis don't allow a change of address for delivery, and make sure that someone is in if/when they do deliver.

 

[Chefren]

IP addresses cannot be cloned, they are not on your local client device they are assigned to that device and then reserved (leased) for the device's hardware address. The OP mentions that PayPal said they have her MAC (= media access control, not MACintosh) address which is such a hardware address, but I don't find that very likely. But if they really do have the MAC address then surely they could provide it as it will identify the device used to make the purchase?

A web site used over a browser will not be able to find the computer's MAC address, so if they really have it, it basically has to be the phone and PayPal's app reading the MAC address of the phone and logging it with PayPal when transactions are done.

MAC addresses can be cloned or spoofed, but the effort and complexity involved in setting up something like that, or to crack the local network and set up some kind of man-in-the-middle attack just to make a prank purchase would be lunacy. Hacking and compromising your router would be more of the same.

It would be more reasonable to look over the shoulder to get the phone's unlock PIN code and then make the purchase when your daughter is not looking. But even then one would still have to get past PayPal's own security, unless the app somehow allows for paying without providing a password.

 

[richardg]

Funny that paypal error has not been suggested.

 

[twotone]

IP addresses cannot be cloned, they are not on your local client device they are assigned to that device and then reserved (leased) for the device's hardware address. The OP mentions that PayPal said they have her MAC (= media access control, not MACintosh) address which is such a hardware address, but I don't find that very likely. But if they really do have the MAC address then surely they could provide it as it will identify the device used to make the purchase?

A web site used over a browser will not be able to find the computer's MAC address, so if they really have it, it basically has to be the phone and PayPal's app reading the MAC address of the phone and logging it with PayPal when transactions are done.

MAC addresses can be cloned or spoofed, but the effort and complexity involved in setting up something like that, or to crack the local network and set up some kind of man-in-the-middle attack just to make a prank purchase would be lunacy. Hacking and compromising your router would be more of the same.

It would be more reasonable to look over the shoulder to get the phone's unlock PIN code and then make the purchase when your daughter is not looking. But even then one would still have to get past PayPal's own security, unless the app somehow allows for paying without providing a password.

Thanks for the explanation.

I may have misheard my daughter re the MAC address thing however she has just told me that she had her phone with her the whole time on Tuesday, even when the purchase was made so the purchase clearly wasn't made from my daughter's phone so that only leaves a couple of possibilities re the IP address thing and that is that the purchase was made from here (my house), there's a glitch on Paypal's system or that it was a genuine error re the same surname however that doesn't explain the delivery address thing.

I honestly can't see any of my daughter's friends or colleagues performing some elaborate prank on her either.

All we can do, I think , is to ask Paypal what IP address was used and if indeed they do have a MAC address for the equipment that made the purchase and take it from there but Paypal are going to have to provide more information other than the device that was to make this purchase was used before as that means nothing unless the device and same IP address was used to make a purchase and they need to tell us what those purchases were cause they could have been insignificant amounts that my daughter wasn't aware of or never really questioned what those purchases were.

I'll update the thread when I find any more info out guys, thanks again.

 

[twotone]

Funny that paypal error has not been suggested.

Well I did in my OP but I would like to know how that could occur?

 

[blossomchris]

Has your daughter order goods from JL before with the same bank details?

Bloss

 

[twotone]

Has your daughter order goods from JL before with the same bank details?

Bloss

Hi Chris, she said that she bought something for £64 from JL on 1st July using PayPal but she elected to pay with the back up debit card not the debit card used to fund the Sonos purchase.

 

[blossomchris]

Hi Chris, she said that she bought something for £64 from JL on 1st July using PayPal but she elected to pay with the back up debit card not the debit card used to fund the Sonos purchase.

Hi Tony, I have had one run-in with P/P, not trying to teach you to suck eggs, but be firm with them and eventually they hopefully will resolve this.
It is always a worry using the internets for money transactions, hope she gets sorted

Bloss

 

[twotone]

Definitely looks like a scam guys, my daughter has just pointed out that the scammer paid for next day delivery and ordered before 8pm but that purchase amount paid entitles you to free delivery so they must have been able to change the delivery address using the next day delivery option on JL's website but fortunately my daughter appears to have managed to stop the payment being made to JL in time.

She's now cancelled both her debit cards and raised a fraud enquiry at both banks John Lewis however has informed her that they can now only communicate with the debit card issuer because of the fraud enquiry.

Presently no payment has been made.

 

[sq225917]

Sounds like a system error between jl and paypal. Change all passwords, via a different computer not her phone or on your house network.

They'll work it out.

Report cards lost if totally paranoid.


Happened to me with a Japanese fishing tackle shop..

 

[calorgas]

No chance she could have accidentally unlocked her phone in her pocket and the purchase is a result of random contact of her fingers to the screen? I've managed to unlock my phone in this way without realising it as it uses fingerprint recognition, never purchased anything but I have managed to ring someone once (who fortunately quickly twigged that I wasn't actively participating at the other end!) and opened a bunch of settings dialogs and turned on some phone features another time.

Just a thought, given the otherwise inexplicable nature of the incident.

 

[twotone]

No chance she could have accidentally unlocked her phone in her pocket and the purchase is a result of random contact of her fingers to the screen? I've managed to unlock my phone in this way without realising it as it uses fingerprint recognition, never purchased anything but I have managed to ring someone once (who fortunately quickly twigged that I wasn't actively participating at the other end!) and opened a bunch of settings dialogs and turned on some phone features another time.

Just a thought, given the otherwise inexplicable nature of the incident.

Thanks, that is possible, I've managed to call people loads of times, well the phone has managed to when it's been in my pocket so that is definitely a possibility but it's looking more and more likely that her PayPal account has been hacked or her John Lewis account has.

I think the key here is the next day delivery option but it's odd that they made the purchase at about 6pm when it would have been likely that my daughter would have received the purchase email from Paypal but they had to make the purchase before 8pm for next day delivery so I guess that they were just hoping that the payment wouldn't have been stopped so quickly.

I had no idea that you could pay for something with PayPal and then have the purchase sent to another address but John Lewis's website allows you the option to change the delivery address so surely that is a problem security wise?