When cyber thieves use PayPal as portal to bank account

November 30, 2010

Ronda Mills is used to drawing crowds. She produces art festivals throughout Southern California, including multiple events annually in Palm Springs and Burbank.

But one place she doesn't like seeing a lot of traffic is her Wells Fargo checking account, which has been repeatedly drained by scammers in Canada and India who have fraudulently linked it to online PayPal accounts.

This has happened four times over the last two years, and each time Mills, 54, has had to close her checking account and open a new one. The latest breach occurred this month.

"It's been a huge hassle," the Valencia resident told me. "I have a lot of automatic bill pays, and each time I have to shut them all off and then reset them. I've also had a lot of bounced checks as a result of this."

And, amazingly, neither Wells Fargo nor PayPal has been able to get to the bottom of the problem and keep the scammers at bay.

Mills' troubles highlight the ease with which con artists can access people's money using digital-age financial services like PayPal, which is owned by auction giant EBay and is used to facilitate online payments.

It also serves as a warning that existing safeguards can be of little help when scammers apparently have ready access to confidential financial information.

At this point, nobody knows how the scammers were able to obtain Mills' checking account and routing numbers, even though she was issued new numbers each time.

It's possible the scammers have access to Mills' computer via a software virusor some other high-tech means. It's possible the account of one of Mills' business associates has been hacked, providing access to her financial data. It's even possible the leak comes from someone at Wells Fargo.

Mike Vergara, PayPal's director of risk management, said he's betting the problem lies with Mills' computer.

"The scammer probably has malware in the machine and has access to all her information," he said. "Even if she keeps changing her account, the malware gives access to the new number."

read the rest