Truth 30 PayPal scams

Sometimes identity thieves realize that they need help to pull off the perfect score. And sometimes the identity the thief is pilfering is not that of a person, but that of an entire business. This Truth is based on actual events that occurred when a coworker of mine decided to sell his laptop on Craigslist.com.

Myles is a security engineer I work with at TraceSecurity. He recently had been given a new laptop by the company, so he no longer needed his personal laptop he had bought just a few months earlier. Like millions of other people, he decided to sell it on Craigslist.

Myles posted a simple ad stating the details of the laptop and an approximate asking price. After a few days, he received an email from someone who said she was very interested in purchasing it. Not only that, she told him she would be willing to pay extra if he would ship it to her in another state even though he had offered it for local pickup only. Being the entrepreneur that he is, Myles accepted the increased offer.

A couple days later, Myles received the confirmation email from PayPal indicating the funds had been received for the laptop. Also, the buyer emailed the shipping address to him. Since the buyer had paid almost $100 more than the original packing price, Myles put extra effort into bubble wrapping the device to make sure it traveled well. All that was left to do was drop the box in the mail, and the transaction was complete.

However, being one of the many paranoid people who have passed through the halls of our company, Myles couldn’t help but think that something just didn’t seem right. Sure, the buyer had seemed pretty cool in the emails they had exchanged, and more importantly had already paid through PayPal, so what was the problem?

Well, fortunately for Myles, the paranoia was justified. On a whim, he logged into PayPal and reviewed all recent payments to his account. As he looked through the list, the payment for his laptop seemed to be missing. This was rather odd, as once he had received a payment via PayPal, he wouldn’t expect it to then disappear. Also, had the funds been removed, there should still have been a log of the events. He then thought that maybe he had been mistaken about the verification email he had received from PayPal confirming the payment for the laptop. He went back and looked again. Sure enough, the email was there, and indeed PayPal had confirmed the funds.

At this point, it all started to become clear. The buyer had never actually paid anything. Instead, the buyer simply impersonated PayPal by sending the confirmation letter on PayPal’s behalf. Had Myles just accepted the phony email without additional review, he would have been out one laptop.

But the story doesn’t end there. Once this was brought to my attention, I thought it would be fun to track down the buyer and let the police take care of business. After making some calls and getting law enforcement involved, we were able to trace the delivery address to a small town in the Midwest. When we spoke to the town sheriff, he was perplexed. It turned out that not only did he know the address the laptop was to be delivered to, he lived on the same street and knew the family who lived there. During the call, he informed us that the home was occupied by a husband, his wife, and their 16-year-old son. Immediately, we focused on the son, though the sheriff did make a point several times during the call to say how surprised he was about the situation, as the boy had never been in trouble before and seemed like a good kid. I have met identity thieves who were extremely likable and charming, so this was not a surprise to me.

What did surprise me is the next call that came from the sheriff. Instead of the son being out to make a quick buck, it turned out that it was his mother. The sheriff had stopped by the home of the boy just to let the parents know what was going on. While he was explaining the situation, the mom grew silent, and by the time he was done, the mom was in tears.

Mom had recently found a job on the Internet where she could earn money while working from home. All she had to do was ship equipment that was sent to her home to a mailing address overseas. For her efforts, she would be paid cash or could keep items for herself. So when the thief impersonated PayPal and had Myles send his laptop to this woman’s home, she in turn would’ve shipped it to another country. Had all this happened, Myles would have been after the woman in the Midwest and not the real thief living overseas. Ultimately, the mom learned a valuable lesson, and the real thief got away without so much as a warning. Fortunately, protecting yourself from this type of attack requires only basic due diligence.

Never trust an email verifying that funds have been deposited into your account. Before you ship the item, simply log into your online account and verify that the funds have truly been deposited.

While there are many legitimate business opportunities that you can find online, always research the employer. Make sure the employer’s address is in the same country in which you reside and that it is not a P.O. box. Make sure that the phone number is local and, if possible, get a tax ID number, which should help you verify that the organization is real, not a front for a thief.

Remember that identity theft can take many different forms. It is just as easy to impersonate a business as it is to impersonate a person. Luckily, the solution is almost always the same. Simply take the time to verify the information being presented.