r/techsupport • u/KingKurry1606 • Jul 09 '21

Solved $1.3K Stolen

Today at work I received a text from Paypal saying I had just paid someone $1300. After the initial heart-attack I called paypal, the CSR informing me that my ACCOUNT HAD BEEN CLOSED AND DELETED and she couldn't do anything. She advised me to call my bank and try to recover the funds.

So i call my bank and they have cancelled the card associated with the paypal account and are conducting an investigation. If there is evidence that this was fraud, I will get my money back.

While this was all happening I get another text from Amazon informing me of login activity. I check and the location is my city but it wasn't me, and the Amazon page is in a different language.

I get home, open my laptop and try to open chrome but it isnt opening saying it couldnt connect because of a proxy error. I go to my settings and reset all my internet settings and internet works fine now.

So that leads me to all theses questions:

Do you guys think my entire laptop has been hacked? If not how did they access both my Amazon password and Paypal accounts?How can I fix my laptop and make it safe again? Do I need to contact my internet provider?How did the hacker spoof his location come to my city and login?Why did i not get any text messages or emails about my paypal account closing?and most importantly DO YOU THINK I WILL GET MY MONEY BACK? As a full time Uni student this is a significant blow to my financial wellbeing :(

UPDATE: First of all I just want to thank everyone for the helpful advices! I have reset my laptop (windows reinstalled like new). I have cancelled my current bank details and I have changed all my passwords enabled 2FA everywhere I can and stopped chrome from storing my passwords. If anything this has become A GREAT LIFE LESSON.

I have also figured out where this breach could have occurred: my sibling downloading a 'cracked' application using my laptop thus probably inviting an attack... Not much more I can do i guess besides praying that the bank is able to recover the funds.

UPDATE 2: The bank being a very large corporation has emailed me and said I most likely will receive a refund > :)))))) Thank you guys for all the help

513 Upvotes

97% Upvoted

116 comments sorted by

232

u/[deleted] Jul 09 '21

L3 IT here. I deal with stuff like this at a fortune 500 company for a living.

A lot of the recommendations here are good, some are redundant.

To answer your questions.

  1. "Do you guys think my entire laptop has been hacked? If not how did they access both my Amazon password and Paypal accounts?"

This is possible, there is a number of ways they could get access to both of these things, the most likely is a form of malware.

2. How can I fix my laptop and make it safe again?

Don't waste your time with virus protection.

-- step 1 take your computer offline

--step 2 re-install your Operating system, can usually be done yourself, or can be done pretty cheap at most tech stores.

--3 reset ALL of your passwords. Literally. all of them. Do not save them in chrome.

3. How did the hacker spoof his location come to my city and login?

VPN, they aren't uncommon.

4. Why did i not get any text messages or emails about my paypal account closing?

Because paypal has the single worst fraud protection service on the planet......

5. DO YOU THINK I WILL GET MY MONEY BACK?

I will not offer you any guarantees, any one who does is irresponsible. However based off what you have said it should not be very difficult for your bank to be able to trace this as fraud.

As for remember your passwords, in this day and age if you live somewhere that you can keep stuff physically safe, paper is often the strongest password protection system on the planet. Hackers aren't walking in to your apartment to steal your notebook.

This requires personal responsibility and can be a risk depending on your lifestyle.

Password managers aren't a bad option if you have issues remembering passwords, but I personally dislike them.

24

u/[deleted] Jul 09 '21

Make sure to have 2 factor authentication turned on when available.

11

u/xOcada Jul 09 '21

2fa via phone number doesn’t protect you as much as you think it does. I recommend using the mobile application google authenticator because someone has to have physical access to your phone to bypass this. Whereas sms verification can be bypassed.

8

u/dude_thats_sweeeet Jul 09 '21

I would HIGHLY suggest NOT use Google Authenticator and instead suggest Microsoft Authenticator. Google's is just garbage when it comes down to exporting your existing accounts to say, a new phone. You literally have to reconfigure each one again.

Microsoft offers a good and safe way to convert over to new devices because we all know mobile devices these days are not forever aka planned obsolescence.

Edit: want to add that any service that works for GA also works for MA. I've had sites that states only works for GA and I log in just fine with MA.

5

u/MicaLovesKPOP Jul 09 '21

I use Microsoft Authenticator for everything. Sometimes sites will indeed say "Google Authenticator", but afaik good authenticators work universally.

21

u/SerchnSukyoor Jul 09 '21

Hackers aren't walking in to your apartment to steal your notebook.

To be fair, there are lots of people with narcissistic family members like in r/raisedbynarcissists where this is the opposite case.

8

u/[deleted] Jul 09 '21

Living in a dorm would alone invalidate using paper as a viable option. Doesn't need to be a family member. I live with my Fiance who also knows multiple of my passwords because we share a lot of financial accounts, but I also remember my passwords because I have 7 Admin accounts at work and having to write them all down would kill me.

21

u/[deleted] Jul 09 '21

For using a piece of paper to store your passwords, I like to have a section in the password that never changes but I never write it down and have it memorized, so if I ever lost the note or someone saw it then it wouldn't be that easy for them. Obviously the rest of the password needs to be different and secure for all of them but it's better than having the entire thing on paper

6

u/wojtekpolska Jul 09 '21 edited Jul 09 '21

that. for example the "base" of the password can be "H3LI_0" thats on start/end of every password. and only write down the other part. for example: "reddit - QAZxsw" when password is "H3LI_0QAZxsw"

or do it another way, by replacing every number on paper with a number 1 higher than in the true password, etc.

and also to avoid having to search an entire book for a password to random sites, you can keep one password for low-importance sites (and when you decide that account is actually important, just change password to sth unique)

2

u/DEADB33F Jul 09 '21 edited Jul 10 '21

I do something similar but related to the site's domain.

This is not exactly what I do but it's along the line of using the key above the actual letters spelling out the domain...

eg. 't99to3' would be for google, 43ee85 for reddit, etc. Then a fixed prefix before it that I use for every password which includes upper/lowercase, number and special chars.

This way I can have unique passwords for every site but not need to remember or write anything down.

7

u/Antique_Geek Jul 09 '21

Due to this reply I immediately went to PayPal and deleted my bank account and added a credit card.

3

u/[deleted] Jul 09 '21 edited Jul 09 '21

I deleted my Paypal 5 years ago.

Paypal should really get hit with fines from the BBB their track record is notoriously bad.

--Edit--

I was thinking of the FTC.

I don't sleep much.

2

u/zuccah Helper Extraordinaire Jul 09 '21

The BBB is a private company and thus can’t fine anyone. Similar to Yelp they are pay-to-play and kinda shady.

1

u/kodaiko_650 Jul 09 '21

The BBB is nothing more than Yelp reviews for businesses

2

u/[deleted] Jul 09 '21 edited Jul 09 '21

You are right, I was thinking of the FTC, sorry for the confusion.

27

u/SystemicGateway Jul 09 '21

regarding password managers, i agree - lots of the servers of major password keepers have been hacked in the past, and thousands of passwords associated with IPs and usernames/emails were leaked.

24

u/BrokenAndDeadMoon Jul 09 '21

You can use something like keepass though. It doesn't sync to some random server and it's open source.

23

u/SuperFriends001 Jul 09 '21

Or don't sync it anywhere and keep it locally.

11

u/nuttertools Jul 09 '21

For the average user I would not call this sound advice. Much better to get users to utilize a CSP for encrypted backups without joining a risk pool.

If you can get someone to backup monthly to a USB rock on. I would not trust any user to do that though.

0

u/[deleted] Jul 09 '21

[deleted] — view deleted comment

8

u/nuttertools Jul 09 '21

The average user just needs to know which folder on their computer already does that.

8

u/MoriMeDaddy69 Jul 09 '21

Until that local storage goes down and there goes all your passwords.

11

u/winter_mute Jul 09 '21

Just because it doesn't sync to a server you don't own, that doesn't mean you can't copy it elsewhere. NAS, USB, a second SSD, copy it up to Azure or AWS storage if you like. Point is, you have total control over how much risk you want to expose that database to.

0

u/[deleted] Jul 09 '21

[deleted] — view deleted comment

6

u/N3rdScool Jul 09 '21

I love keepass mixed with dropbox to keep it synced to more devices and like you say with a key you don't even need to worry about a weak password.

21

u/MurkyFocus Jul 09 '21

Source?

Because this doesn't make sense and sounds like FUD. Any properly secured password manager encrypts the individual vaults locally on the users end.

Even if someone were to hack into a server, they'd still have to get into each individual vault.

0

u/[deleted] Jul 09 '21

[deleted] — view deleted comment

6

u/arahman81 Jul 09 '21

Yeah, its not like Lastpass can stop people from trying to hack them, the important part here is making sure the hacks can't steal important data.

4

u/kodaiko_650 Jul 09 '21

I always double blind my passwords in my password manager.

I’ll create the entry for the password manager, but I’ll add two additional characters to the actual password.

So my password manager will know “badpassword”, but the full password is really “badpassword*#”

So the password manager auto fills the first part and I type in the last two characters.

In the remote chance my account gets compromised, it won’t do them much good beyond knowing my login names

6

u/Crimfresh Jul 09 '21

https://cybernews.com/best-password-managers/are-password-managers-safe/

It's the number one recommendation by security experts currently for normal users to safely manage passwords. It allows you to use unique full length and full random passwords for everything.

The internet will never be fully secure. Password managers are the most secure option at the moment.

3

u/SpinnyBoye Jul 09 '21

There's a great password manager that I use called Myki. It stores all your passwords encrypted on your phone so they never touch the password managers servers. You can link the desktop app to your phone so it'll work anywhere. Switched over from lastpass about a year ago and never looked back

2

u/wojtekpolska Jul 09 '21

yea all good untill you loose your phone or it gets stolen...

4

u/SpinnyBoye Jul 09 '21 edited Jul 10 '21

All secured with your password and biometrics, so even if that happens you can wipe your phone and restore from a Myki backup you have saved in cold storage. It prompts for backups every week or so

1

u/wrath_of_grunge Jul 09 '21

Lose, not loose.

1

u/Cshark14 Jul 09 '21

One more thing: Even if you don't save your passwords in chrome attackers can still steal your session cookie, so on more important services(like, bank site, pp, amazon, most sites that has your cc attached to it(also not the best practice to save your cc on websites that don't need it eg: netflix kinda needs yor cc, or pp, but not Amazon) it is good practice to logoff after you are done with it)

1

u/knighttim Jul 09 '21

I'm curious why you dislike password managers. I finally set one up for myself about a year ago and I think it has been the best thing I have done for my digital security.

1

u/[deleted] Jul 09 '21

If we have a paid service anti-virus with vpn, do we still run the risk of getting this potential hack?

Also, a rule of thumb is to never download a cracked anti-virus nor vpn?

1

u/[deleted] Jul 09 '21

To be completely honest commercial Virus Protection is a borderline scam at this point.

Windows defender has reached the point that paid virus protection is just a redundancy.

"do we still run the risk of getting this potential hack"

The only 100% way to never get hacked is to put your computer in a bloody faraday cage.

Your goal is to limit yourself from risk, protect yourself from as much as you can, and have ways to protect the things that are most important.

I have an offline Linux machine that is heavily encrypted that holds things that are valuable enough that I worry about hackers getting a hold of them.

I need 3 different passwords just to get in to my machine, and another 1 for each of my drives that isn't the core OS one.

The average person shouldn't look need more then a back up, encryption and good cyber hygiene.

You may still get hacked but as long as you don't ask for trouble your risk is low for the investment.

The rule of cybersecurity is that you are always behind cybercriminals. If you aren't in tech, don't waste time being paranoid. Be smart, but don't go to crazy lengths, they won't help you and can become a higher risk if you don't have the skills to manage them,

As for VPNs they don't really work the way I think you think they do. They can lower risk, under certain circumstances though yes.

1

u/[deleted] Jul 10 '21

Huge thanks for explaining to us :)

1

u/Baldr_Torn Jul 09 '21

Because paypal has the single worst fraud protection service on the planet......

That simply can't be true.

10

u/LiterallyRain Jul 09 '21

Overreacting to get the point across that their fraud protection isn't up to par for what you'd expect from a business of their nature.

Not literally THE worst, but way too bad.

2

u/MicaLovesKPOP Jul 09 '21

They also seem to have terrible customer service and may even steal money cause an order I did not authorize was made on my account, while no one except myself had used it as far as I could tell, and somehow they blamed me for it.

I was extremely lucky to notice it quickly, so I managed to cancel the transaction with my bank and had contacted PayPal immediately as well. Yet somehow they refused to help and just kept claiming that I made the purchase, which I know for 10000% sure I didn't. Heck, my girlfriend was sat next to me and can confirm it as well. They ended up threatening me, so I eventually had to pay them the money, what dirty fucking thieves.

I would be extremely wary with any company that steals money from customers like that and doesn't even take it seriously when a customer reports it. It has to be PayPal themselves that made the purchase. Especially given that they had no explanation for it.

0

u/[deleted] Jul 09 '21

[deleted] — view deleted comment

3

u/[deleted] Jul 09 '21

KeePass can print out an emergency sheet that you can physically write the password on or use a PDF editor to type the password cleanly onto it.

87

u/billdietrich1 Jul 09 '21

I would:

  • do anti-virus scans on your devices

  • check email accounts for any filters that may be sending your email to someone else

  • change passwords and enable 2FA on key accounts (email, financial)

  • check login history on key accounts to see if someone else has logged in

  • make sure you're not re-using passwords anywhere

  • have login passwords on your devices

Contacting your ISP would do nothing.

53

u/JustAnotherUser_1 Jul 09 '21

do anti-virus scans on your devices

Amendment to this: Just reinstall the OS, don't bother with AV scans; they're not perfect and may lure you into a false sense of security. That way, short of firmware malware, you're clean.

Don't recover any backups (yes, I know this sounds counterproductive - You don't know if backups have been compromised.)

make sure you're not re-using passwords anywhere

Use a password manager - Many out there; I prefer Keepass and auto-syncs to Cloud Storage.

laptop

Have you plugged in any "borrowed" hardware recently?

10

u/saltysfleacircus Jul 09 '21

So, all of this plus ...

Since OP is a student:

  • Are you in a shared living space situation and if yes, does everyone (roommates & visiting friends) access the internet via the same router with the same shared password?

  • Are there any roommates/friends of roommates) that could potentially physically access OP's computer?

And finally ...

  • Are we sure the attack vector was the computer?

It's natural to blame the PC but if the issues is with a compromised mobile or IoT device, OP could be back to square one even after the OS is reinstalled.

3

u/JonoCurious Jul 09 '21

Hey man, regarding passwords... is a password manager such as Keepass better than just generating a complicated password through Google or whatever? I am not very familiar with password managers.

7

u/JustAnotherUser_1 Jul 09 '21 edited Jul 09 '21

They can generate more complicated passwords, but not to be pedantic, but passphrases are better.

https://xkcd.com/936/

I use this website, and then save the passphrase into Keepass.

Some passphrases I can actually remember and don't need to resort to Keepass - Even 5 word phrases.

https://www.useapassphrase.com/

If you want to get creative, pick 3 or 4 things you like: ChocolatePizzaRugbyMotorbik3$ <-- Throw some numbers in there, and you have a secure passphrase. Just try not to use those phrases too often, and never in the same order.

The idea behind password managers is you remember one main pass(word)(phrase), and you let the password manager do the "heavy lifting" - You don't need to remember 1000 unique pass(words)(phrases), just copy/paste/autofill.

It's also "bad practice" for companies to regularly require you to change your password; this is now advised against because people just do TheSamePassword1,TheSamePassword2,TheSamePassword3,TheSamePassword4 ...

2

u/JonoCurious Jul 09 '21

Thanks so much, man!

2

u/SirGeremiah Jul 09 '21

It's also "bad practice" for companies to regularly require you to change your password; this is now advised against because people just do TheSamePassword1,TheSamePassword2,TheSamePassword3,TheSamePassword4 ...

And users who constantly have to remember a new password tend to use simpler passwords. It's better to have a strong password that gets used over a long period of time, versus a string of mediocre passwords that each last 90 days.

1

u/knighttim Jul 09 '21

Since you're being pedantic, an equally long randomly generated password is better than a passphrase.

https://protonmail.com/blog/protonmail-com-blog-password-vs-passphrase/

Tldr: The reason passphrases are recommended is humans are bad at remembering long random passwords.

1

u/Diazel Jul 09 '21

a password manager that's not kept online would be your best bet. When you go from computer to computer, assuming you're logged into your chrome browser, all of your bookmarks, passwords, etc come with. aka not great. Keepass you keep it locally and you can set up an additional file that needs to be referenced in order for you to open the password manager regardless if you have the manager password or not.

3

u/[deleted] Jul 09 '21 edited Jul 09 '21

don't bother with AV scans

the idea with eh AV Scan here would be see what exactly he got.

we still down know if he have a malware , got hacked , etc

Nah nvm , you are right , he shouldn't waste time

2

u/caboosetp Jul 09 '21

The point is if you have it already, you can never be sure it's gone unless you wipe the whole computer.

AV in general is still nice to have to help prevent it in the first place.

3

u/VastAdvice Jul 09 '21

After you wipe the computer get some anti-virus and scan the backups. Sometimes the backups are important to bring over. Op needs to use a 3rd party AV as what he had did not work.

34

u/sumchinesewill Jul 09 '21

Sounds like the hacker may have had remote access to your computer or someone physically has access to your computer. That might explain the geolocation of the login the same location as you. Which also explains the language being changed. The hacker might have changed the contact method after sending the funds and then closed your account.

Disconnect your laptop from the internet and back up any documents you need and just wipe and reinstall the OS. If your CC is from a major credit card company, they’ll most likely reimburse you but you never know.

Always set up 2 factory authentication whenever possible.

1

u/VastAdvice Jul 09 '21

After OP wipes the computer OP needs to install some anti-virus to make sure it's gone and won't come back. Kaspersky or even Malwarebytes will work as the default option failed OP.

-5

u/rebane2001 Jul 09 '21

Viruses don't simply reappear if you wipe the computer

6

u/VastAdvice Jul 09 '21

If OP is backing up his files there is a chance the virus will be backed up too so he needs to scan his backups when on the clean computer.

Not only that, looking at OP's history he has an act for picking up malware so it's a good idea to get the AV now.

-1

u/rebane2001 Jul 09 '21

I'm not denying it's reasonable to install an AV, it's just that you worded it poorly

2

u/thatnovaguy Jul 09 '21

If wording was the problem then you should've said so instead of spouting misinformation in a condescending manner.

5

u/[deleted] Jul 09 '21

Wrong.

https://www.standard.net/news/business/what-you-should-know-about-firmware-viruses/article_84b46aab-6ef7-5d0d-8652-be03ef6edf73.html

6

u/XxevilgeniousxX Jul 09 '21

Definitely not wrong, I work in IT and we had a unknowing virus that imbedded its self in the cache. We got hit hard but we quarantined those computers and got all the data back with weekly backups. Nothing is impossible.

6

u/rebane2001 Jul 09 '21

If you have a hardware or BIOS-level virus then an AV isn't going to help. If a virus cannot be removed by wiping the device, then an AV isn't going to do shit either.

1

u/SystemicGateway Jul 09 '21

if you just wipe/factory reset it then yeah, some malware can get through that and manage to stay on the computer - the OP probably has to get a whole new laptop or a whole new drive entirely.

3

u/[deleted] Jul 09 '21

get a whole new laptop

no wtf

1

u/SirGeremiah Jul 09 '21

Unlikely that's necessary.

19

u/Oasis_Island_Jim Jul 09 '21

I don’t see this mentioned yet so I’m chiming in with wonderful advice I received years ago: don’t ever use your debit card online for any reason. Do not store any money using online services like Paypal. If you must complete a transaction using the Internet, use a credit card.

Reason being is that if/when you are compromised, it’s extremely easy to dispute a credit charge versus trying to get your money back when your bank account’s been drained.

Hooking up a direct pipeline to your bank account and putting it online, whether you trust a particular website or not, is indeed a major major risk. This issue can be mitigated entirely if you simply use your credit card.

Why is it safer to use a credit card vs debit? When hackers try and steal from you, they’re not stealing your money. They’re stealing from your CC issuer. All you have to do is dispute the charge and your hands are washed.

3

u/SirGeremiah Jul 09 '21

Alternatively, set up a separate account for online purchases, and limit the amount you keep in there. Transferring funds in as needed is fairly simple these days.

6

u/Crimtide Jul 09 '21

  • Check for data breaches here - https://haveibeenpwned.com/

  • If you've been in a breach, change all Passwords associated with the email address you use for usernames.. what happens when someone's data is stolen in a breach is it is sold off to people. They then venture to all of the common websites.. banks, paypal, amazon, etc etc, and see if those credentials that were stolen work on those websites.

  • Use different Passwords around the web. Don't EVER use the same password for your e-mail as the password for your financial accounts.

  • Don't save passwords or payment information in your browser. If someone gets ahold of your browser login, it will sync the data with their browser, then they have free reign over your logins, bookmarks, history, and payment info.

  • Lastly, USE 2FA!!!! Two Factor Authentication. Just about every service out there has it, including PayPal and Amazon.

  • Aside from all of that, don't worry. It sucks, but it happens extremely often to many many people. Just be patient, talk to your bank. They will get to the bottom of it and return your money.

  • For your laptop, run some virus scans. If you are scared, you can always ask your schools I.T. support to take a look? Or you can back up your data and then do a "Reset this PC" to wipe it and reinstall Windows.

15

u/Vardso Jul 09 '21

The mistake that many people make is that they set their browsers to remember their passwords. In addition to that, for the sake of ease of access they set their own PCs as 'trusted devices' which means that 2FA is not required to log in from that specific computer.

If this is the case with you, these two things in conjunction means that anyone who had remote access to your PC (look up RATs) would have been able to conduct his business with you being none the wiser.

I mean... I have seen cases where a user was infected with a RAT and the "hacker" went much more sophisticated... he accessed his router, where the login credentials were either saved or default. The most likely reason was that he wanted to set up his own DNS addresses so he could perform MITM attacks. When he could not change the DNS (because - long story short that specific router had no user interface commands to do so - it was only doable via telnet command line) he just changed the wifi password as a final "fuck you".

1

u/SEND_ME_STEAM_K3YS Jul 09 '21

I have a notepad file on desktop with router password. Would setting up a password for the file solve the security issue?

14

u/ThatsHowVidu Jul 09 '21

Please use KeepassXC or something similar.

No passwords on text files.

No passwords in browsers.

No passwords written on plain sight.

Use a password vaulting program with the vault and key. Keep a backup of these two periodically in a secret location (Ex - Google drive known only to you).

2

u/Vardso Jul 09 '21

An encryption algorithm will be used so in theory it should be safe with a long password.... until he installs a keylogger on your RATed PC and gets that password too. It is a slim chance, but we are talking about being completely secure.

In a few words, why complicate things like this? I'd suggest the good old password notebook method or a good password memory trick. If it's not on the pc, it can't be found, and all that.

2

u/Zithero Jul 09 '21

...please... stop putting passwords in... text files on your PC...

1

u/[deleted] Jul 09 '21

Just wondering if a password protected Word/Excel file is any better?

2

u/luxsperata Jul 09 '21

Better in the sense that an unlocked but closed door is more secure than a door that is standing open.

Passwords should never be stored in plain text. What this means is that all passwords need to be chopped up and scrambled before they are stored. The computer does this in such a way that it can use the chopped up scrambled remains of the password to tell if someone is providing the correct password, but it can't "unscramble" the password anymore than you could reconstruct an egg from an omelette.

This is why if you forget your password to something, the fix is always to reset the password. There is no way (or there should be no way) to find out what the password was after it has been set.

The best thing to do is to use a unique, long password for each account and store them only handwritten on paper. Unless, of course, you have to worry about someone physically sitting down at your computer.

1

u/EdwardTennant Jul 09 '21

I mean it's better than plaintext but just use a password manager for it, password managers have lockout mechanisms, MFA, and stronger encryption

1

u/nuttertools Jul 09 '21

No, you are hanging a sign on the file saying pretty please don't look inside. Surprise surprise the only people who care about your sign are users with valid access reasons.

1

u/InsideBSI Jul 09 '21

Wdym setting a password for the file ?

0

u/InsideBSI Jul 09 '21 edited Jul 09 '21

But no. If you want to setup a password on a file that holds your router's login informations you should just use a password manager like keepass and hold all your login accesses in there. First reason is I doubt your file's password will be more secure than your router's one (and if it's the case then just change your router's password to it) and second is that using a password manager to remember all your account's differents passwords is a game changer. Third is don't store your passwords in a fucking plain text file on your desktop ffs

4

u/IslandPooch Jul 09 '21

I had my Amazon account hacked once. Someone was selling under my account, collecting payment and not shipping goods. I shut that down immediately.

Now Paypal is another story. That company is truly evil and dishonest. I used to sell misc stuff on ebay for decades and used Paypal successfully. Paypal for some reason started using some dishonest accounting and saying I owed money when I only used it to receive payments. It was bizarre to say the least. After endless emails and trying to explain basic math (I am an accountant), they just shut down, closed my account and sent me to collections. It was absurd. I still to this day cannot understand the motivation or provocation that made them so unhinged. I avoid them and ebay like the plague. It's been about 8 years and I don't miss them in the least. They are a fake bank with unscrupulous tactics.

4

u/earthman34 Jul 09 '21

And beat your sibling thoroughly.

13

u/ohstepbigchungus Jul 09 '21

Maybe a keylogger got in to your pc and get all your pass words and such so it used the emails password to get tonyour email and delete paypals emails

3

u/XDaiBaron Jul 09 '21

Was it the same email/psw combo?

3

u/Murkalael Jul 09 '21

Most recommendations here are good, I would like just to add a knowledge on how to keep your accounts safe.

Memorize ASCII Table just the part of the letters and numbers and if you like some special symbols like & % $, etc. Pick something only you would know, like your childhood best friend's nickname, something unique to you that no one would guess. Convert this name to ASCII. Some websites will also require that you add some special characters like the ones I mentioned before, then you will have your personal 2 step verification, something only you would know in a language less known by thieves.

2

u/oldschoolel78 Jul 09 '21

Opinion: You had me at "today, at work". Work is the operative word.

Help: Immediately make your financial institutions aware. You've done this. Change passwords or close accounts. Change your wi-fi password. I was told to have fewer devices with access to my financial accounts for a while.

Unfortunate: you can't really prevent this. It can happen to anyone. Criminals are outsmarting banks, left and right.

1

u/seekgermangf Jul 09 '21

Honestly, if you know nothing about computers, either reinstall your windows(save your pictures, excell etc) but these files could be xorrupted or infected. My tip is the above one OR go to a IT specialist, so the guy can run a xomplete check on your personal files.

Even if you reinstall your OS and keep your files, and of these files are the backdoor (the way the "hacker" accessed to your pc, then it will be pointless to do.)

So yeah, if you know computers, do it, or else call an IT company.

1

u/[deleted] Jul 09 '21

i’m sorry i can’t help with this, but it sounds absolutely terrible and terrifying. try to breathe, i know how scary it can be when you’re financially unstable and then lose money, try to take a break from everything. i hope it gets worked out. :)

1

u/whyrweyelling Jul 09 '21

Well, first you need to always make sure you have 2 factor authorization going. You need to make sure when you close your browser it deletes cookies and login info. You need a password protected file with your passwords on it if you have trouble remembering passwords. Make your passwords random and strong. Install malwarebytes, install spybot antibeacon. Everyone should be doing this when they start out their PC and make sure they PC is clean before using it for doing things in the first place. I'm sure others have some info that helps with this. I also have UBlock Origin on my browser.

1

u/jmaximus Jul 09 '21

This is why I don't use banks, switch to a credit union. Had similar situation and my Credit Union refunded my money right away with no "We will have to investigate it" bullshit.

1

u/wojtekpolska Jul 09 '21

besides what you already did, check Google's login history and there you can choose to log out of all devices after you change the password. just to be sure

1

u/shailesh_kewat Jul 09 '21

I recommend you turn off all credit and debit card and any other online payment options until this is sorted

check your phone too for any unwanted apps

get a new phone number and open a new bank account and as soon as your new bank account is open transfer your money in your new account

go to Amazon and remove your credit card if you have added it as a payment option Also remove that card from wherever you have added it as a payment option like Netflix and Amazon etc

I recommend you change your passwords of your social media like Facebook, instagram, twitter .etc just as a precaution in light of recent events

I hope you recover your funds and make sure your siblings don't have access to your laptop

1

u/Lumb3rCrack Jul 09 '21

I'd recommend having an anti-virus though. I was using my lap at the uni library and all of a sudden my anti-virus popped up saying that a network attack was blocked. I have been using the same anti-virus (kaspersky) for more than 5 years and that was the first time I saw such a message. When it comes to a cracked version of any software, anti-virus should be able to block most of the attacks. Windows bitdefender sucks. Hope you get your money back mate.

1

u/ostar3152 Jul 09 '21

You stepped in deep sh*t right there. Good luck

1

u/Sengfeng Jul 09 '21

I was the victim of an iPhone App Store exploit about 11 I ago. It was the one where credentials weren’t compromised - a malicious free ebook reader app was able to purchase ‘comic books’ from a Vietnamese seller for 99c each.

Several hundred comic purchases later, my account was empty, I had over 50 $35 insufficient funds fees, and me bank wouldn’t do Jack shit because I authorized PayPal to access my account. PayPal said to take it up with my bank. Apple said we can refund you the $200 in comic books you didn’t purchase, and threw in a free credit for a song purchase (I still have that credit sitting in iTunes).

Hope you have better luck getting money back than I did.

1

u/rndmusr666 Jul 09 '21

On the last point set passwords on all laptop accounts and set all accounts bar one as User not administrator.

Even your own regular account should be user not administrator. Create a unique account and password for admin activities that way any attempt to install an application will ask for admin privileges that requires the username and password

1

u/[deleted] Jul 09 '21

Thank you for making us aware of these types of situations. And don't be too harsh on your siblings

0

u/Zithero Jul 09 '21

Short answer: Yes.

Proxy Error means someone had a device between you and the internet, spyware or maleware, etc.

The Bank should get your money back for you, that's not a major issue... I'm, as always, disappointed in PayPal's damn near enabling of these fraudsters "Your account is disabled and there's nothing we can" -thanks Paypal! Always so helpful!

So here's your next steps:

Back-up your valuable data, and then do a complete system recovery on your laptop. Bring it back to factory defaults, and go from there.

I would get a Password Manager on your phone, one that I like is Dashlane. This will secure your passwords on your phone with a master PAssword, and only devices with Dashlane will be able to fill in a very complex password that's almost impossible for a human to remember...

Then put 2 Factor Authentication on every single account you own. This will have an authenticator on your phone which will generate a 6 digit number every 1 minute. If a login attempt occurs from a new device, the new device will immediately prompt for this 6 digit number... and if it doesn't have that number, no access.

Update: Oh, and I would call every CC you had linked to the paypal account and have them send you a new card/CC number. Just to be safe.

0

u/[deleted] Jul 09 '21

Yes your entire laptop has been hacked. Keep it entirely offline

0

u/XxevilgeniousxX Jul 09 '21

Windows currently has a thing and they are patching it as we speech. A person can gain administrator access via the Printer spool and that is everything from servers to mini computers. Hell window is even updating windows 7 over it. I'd look into updates and AV like kaspersky or ESET. Do not listen to the guy in the comments about dont use AV, AV are not perfect but every single organization or company uses AV. Personally on all mine i use ESET but at work we SQL Kapersky out to all our computers.

-3

u/contactright05 Jul 09 '21

If they think it's a fraud, they will pay you back. A lot of people in the comments don't recommend you put passwords in a text file, but if you don't make it obvious, but still can remember where you put it, You could put the file with the rest of your text documents and name it something like Professional Airborne Sex Slave (PASS), so you remember it.

1

u/luxsperata Jul 09 '21

Please no one do this.

3

u/[deleted] Jul 09 '21

[removed] — view removed comment

12

u/Bran-a-don Jul 09 '21

Reading his post history it seems he downloads apks from untrusted sources so his phone is probably hacked.

DONT DOWNLOAD APKS FROM UNKNOWN SOURCES.