Paypal Theft Details

Debra Ricketts, 8 July 2003

Since the announcement that was recently sent out, we have received several requests for details on the Paypal theft. We've always had an open-book policy, so here are the sordid details:

We utilize a debit card on our Paypal account to pay for online charges (such as airfare) and when I ship packages out (premium purchases, etc). On Monday, July 7, I checked the Paypal account while balancing our accounts. I was shocked to see our balance was nearly wiped out, with debit charges ranging from $13 to $800 each.

Each of the charges were local to Las Vegas / Henderson area, and was made in the past week, beginning on July 1 and ending on July 6. What is confusing - and ominous - is that I still have the debit card with me. I immediately called Paypal, who cancelled the debit card and instructed me on the process to contest the charges. They also assured me that they had not sent out a replacement card (which was my first thought).

The biggest victim (or perhaps, enabler) is Walmart. A $671 charge was made at a Walmart supercenter in Las Vegas, another for $800 even at a Walmart in Henderson, and a third $800 charge was attempted (and denied) at yet a third store. The other major charges include $200 even at a 7-11, and $138 at Vons, a local grocery chain.

When I spoke with a customer service rep (Sarah) at Walmart, she looked up the transaction and indicated that the card was swiped through a machine. I asked her how that was possible, since I have the card, and she indicated that the card may have been "forged" (i.e. manufactured). When I asked how they could have used it without ID, she said that it is Walmart's policy to check ID.

Obviously not.

In any case, she said there is nothing she can do and told me to contest the charges with Paypal.

7-11 has not responded to my numerous emails and phone calls. In each case, the person on the other line has indicated that a supervisor will call me, and has not. Ditto with Vons.

I have not yet filed a police report, since I wanted to get as much information as possible from the merchants before doing so. I will file it on Wednesday or Thursday. In the meantime, I only know that the person is local to my area and has a card with our number on it. The number could only have been gotten from a receipt at the Postnet I frequent, or by going through my trash. Frankly, I don't know which would bother me more, as I like and trust(ed) the folks at Postnet; at the same time, the thought of someone going through the trash in front of my home gives me the willies.

The woman at Paypal that I spoke to does not seem to think there will be a problem with getting the charges reversed. According to Tim-the-lawyer and others, we should be responsible for $50 at most. The wheels of bureaucracy turn slowly, however, so it will take time to get the money back into our account. In the meantime, as I said, the debit card number has been cancelled and I will be writing checks instead of debiting in the future.

I should add at this point that while Paypal has some legitimate security issues, in this particular instance, they were not responsible for what occurred - that rests squarely on the shoulders of the vendors who accepted the fraudulent card.

Anyone who has any comments or suggestions on how we - I - can improve security, please contact me. This is distressing not only for the obvious cash loss, but because it is my responsibility as Treasurer to ensure the integrity of our funds.

Debra J. Ricketts

Wednesday, 9 July 2003 Dear Members,

Just an update on the Paypal theft. I spoke with Detective Williams at Las Vegas Metropolitan police department Fraud Division (702-229-3285) this morning about filing a report. She asked if we had contested the charges with our bank. I indicated that we were in the process of doing so, as we just found out about the theft yesterday. She said that we had to wait until a decision was made by Paypal before filing a report.

The reasoning is that if the bank reverses the charges, then they (Paypal) become the victim of the financial crime instead of us, and they (Paypal) would need to file the report, rather than us. She said that if we filed a report now, got the charges reversed, and then Paypal filed a report, the report might go to a different detective, who would be duplicating the investigation of the first detective. Consequently, they won't accept the report until Paypal's decision is made.

So, now it's back in Paypal's hands. The paperwork they requested has been filled out and goes out today certified mail.

Debra J Ricketts

Friday, 11 July 2003

The paperwork to Paypal has been sent certified mail. According to several sources who have had a similar experience, we should have the funds returned within a few weeks. Of course, each situation is different, so we're not counting our chickens quite yet.

We've had a shredder donated to us to ensure that in the future, no hard copies of any materials are salvagable (thanks, Scott!). And Von's has finally contacted me about the issue; I will be calling them back today.

Thursday, 17 July 2003

I spoke with Jeff, the manager of the 7-11 that accepted a $200 charge on our debit card. He indicated that while they normally have 30 days worth of video, they only have 7 right now, because the high-end camera (for which I had held high-end hopes) wasn't working correctly. Naturally, by the time he got back to me, the day in question had been overwritten.

Paypal also responded, with the statement, "We have received your affidavits regarding the loss on your debit card. Due to the unabuthorized nature of your dispute and the large dollar amounts in involved, we will need you to file a police report. We will need either a copy of the report or the report number."

So I called Las Vegas Metro once again. Once again, I was told that they won't accept a report until the bank's decision is made, since the bank becomes the victim if they roll back the charges. I indicated that I was still the victim, since this was identity theft. No, it's not, said Mr. Police Man. You don't have any proof that your name was used, only that the card number was used. And since I have the original card, it isn't property theft either. So it's fraud -a financial crime for which they will only accept a report from the final victim. <sigh>

I've let Angela at Paypal know (yes, the Paypal customer rep & I are now on a first-name basis), giving her the contact names & phone numbers of the helpful folks at Metro. I'll update everyone as I find out more.

Thursday, 18 July 2003

SUCCESS!!

Paypal has reversed the charges on all of the unauthorized transactions on our Paypal account. The merchants in question have 45 days for rebuttal, but that shouldn't affect us, since the card used was a forged card and in all likelihood didn't have an authorized user name on it. In any case, it's now between Paypal and the merchants. The only bummer is that we probably won't ever know who was responsible and how they got the number, unless they are caught and I'm called in as a witness.

Here's hoping!