4 ms·

One of the biggest takeaways from this for me is that PayPal has awful security when it comes to compromised accounts. The only reason compromised accounts woul

by Taek 6y ago

One of the biggest takeaways from this for me is that PayPal has awful security when it comes to compromised accounts. The only reason compromised accounts would trade for prices that high is because hackers have a high success rate of stealing funds from them, and a low chance of getting caught. Credit cards and bank credentials being worth comparatively much less means that hackers don't have easy ways to secure the funds - either there's a high risk that the transaction is reverted, or there's a high risk that the hacker gets caught and goes to jail. You can tell it's not just an effort issue because the value of the accounts barely scale as the amounts in the accounts increase.

awakeasleep 6y ago
It's hard to parse your take, I think the phrase 'security' must be overloaded. Considering there are ~325 million active paypal accounts, wouldn't there be a huge supply if their security, overall, was lax? And furthermore, isn't the security of a criminal getting money out of the system only equivalent to getting the money through banks?
- Taek 6y ago
  "Paypal has awful security" -> it is easy and low risk to walk away with a bunch of cash if you get access to a Paypal account. I'll try to re-word the GP, thanks for highlighting your confusion.
- notatoad 6y ago
  >wouldn't there be a huge supply if their security, overall, was lax? i don't think normal demand curve applies to stolen bank accounts. the value of a stolen account would be the average amount of money you can expect to get out of it, regardless of how many stolen accounts are available. An increase in supply wouldn't make that any different.
  - deleted 6y ago
    [deleted]
cainxinth 6y ago
I opened a new checking account just for Paypal that never has more than a $100 in it.
- pc86 6y ago
  Ok
dclusin 6y ago
For the raw account details alone it probably has more to do with being able to use it as a pathway to transfer ill gotten gains into/out of US/EUR than it does w/ the contents of the account. For the transfers from stolen accounts it looks like its just discounted based on probability that the transfer won't be reversed in time maybe?
prodmerc 6y ago
Do they? I mean, logging in is one thing, but transferring? I believe the hacked account owner can just get their funds back, and PayPal is very trigger happy at freezing accounts (especially new or idle) that get a large (a few hundred or more) sum at once. So if you were to gain access to a stranger's account, you'd have to transfer the money to an existing, old and actively used account. Which is likely to be your own or your friend's. Seems like a huge risk, so the hackers just sell the account to some idiot willing to try it.

by Taek 6y ago

awakeasleep 6y ago

It's hard to parse your take, I think the phrase 'security' must be overloaded. Considering there are ~325 million active paypal accounts, wouldn't there be a huge supply if their security, overall, was lax? And furthermore, isn't the security of a criminal getting money out of the system only equivalent to getting the money through banks?

Taek 6y ago
"Paypal has awful security" -> it is easy and low risk to walk away with a bunch of cash if you get access to a Paypal account. I'll try to re-word the GP, thanks for highlighting your confusion.
notatoad 6y ago
>wouldn't there be a huge supply if their security, overall, was lax? i don't think normal demand curve applies to stolen bank accounts. the value of a stolen account would be the average amount of money you can expect to get out of it, regardless of how many stolen accounts are available. An increase in supply wouldn't make that any different.
- deleted 6y ago
  [deleted]

cainxinth 6y ago

I opened a new checking account just for Paypal that never has more than a $100 in it.

pc86 6y ago
Ok

dclusin 6y ago

For the raw account details alone it probably has more to do with being able to use it as a pathway to transfer ill gotten gains into/out of US/EUR than it does w/ the contents of the account. For the transfers from stolen accounts it looks like its just discounted based on probability that the transfer won't be reversed in time maybe?

prodmerc 6y ago

Do they? I mean, logging in is one thing, but transferring? I believe the hacked account owner can just get their funds back, and PayPal is very trigger happy at freezing accounts (especially new or idle) that get a large (a few hundred or more) sum at once. So if you were to gain access to a stranger's account, you'd have to transfer the money to an existing, old and actively used account. Which is likely to be your own or your friend's. Seems like a huge risk, so the hackers just sell the account to some idiot willing to try it.