5 ms·

Anyone else getting occasional 2FA SMSs from PayPal that they didn’t request? Like, I get it, somebody probably has my email address, but I never really got th

Anyone else getting occasional 2FA SMSs from PayPal that they didn’t request? Like, I get it, somebody probably has my email address, but I never really got these before. And I doubt it’s somebody’s typo. Would think a company as big as PayPal would be able to cut off the source once the source requests more than 3 different logins by SMS.

YVoyiatzis 4y ago
I got one a few months ago, an invoice from a contractor. I did bringing it to PayPal’s attention, as I was fully aware of the dubious attempt. Haven’t heard back, invoice still sitting there awaiting settlement.
arbuge 4y ago
I have noticed these coming in over the last few weeks. Didn't get any before.
- Scoundreller 4y ago
  And they come from the right short-code as my legitimate requests. Just noticed my legitimate requests are in the form of “PayPal: xxxxxx is your security code. It expires in 10 minutes. Don't share this code with anyone.” But the last one I didn’t request didn’t have an expiration mentioned: “PayPal: xxxxxx is your security code. Don't share your code.”
  - brewdad 4y ago
    I have a series of these messages, all legit, that match yours. My most recent message, from about 2 weeks ago, also left out the expiration time but I was logging in at the time so it should be legit as well. No suspicious activity since then, so they may have just shortened up the message.
adrr 4y ago
I get it from outlook.com multiple times a day for a password reset. Assuming a six digit code, they do this 1M times a day across multiple accounts to get around per account throttling, they'll get one success. If they aren't using a secure random number generator, they get increase the probability if they can predict the random number seed.
- Scoundreller 4y ago
  Coming soon: “Your login code is 8kqhc1abw0v6n11kmdi0py5lwy. Do not share this with anyone”
  - TakeBlaster16 4y ago
    "This code will expire in 30 seconds."
  - tetha 4y ago
    Stupid idea: Generate ~8 words... and shove them into GPT-3 to create a ~100 word novel, and make that your security code. Suddenly your security code is about a bearded elf, riding a cucumber, wielding a unicorn to defeat ice cream. Try guessing that.
cperciva 4y ago
I've been getting those a lot recently. I assumed it was my phone number being attached to an account which it shouldn't be attached to.
IronWolve 4y ago
Hackers are going through lists of hacked password lists and automated test of each entry, causing tons of gmail/outlook/amazon/paypal/ebay/etc emails. One way to protect yourself is use a different email address, and only for services. Many email sites allow custom addresses, so you can create specific emails addresses for each service. And if your cellphone number is also leaked, get a sms service with a different phone number. https://haveibeenpwned.com https://haveibeenpwned.com and you can do a check on yourself. I find it sad Google sells titan keys but ignores them on login.
MOARDONGZPLZ 4y ago
Just counted, I got 23 of these in the last 30 days. Mostly in bursts. No idea what the deal is.
toast0 4y ago
PayPal offers using SMS to login as a one-time code, without the use of a password. So it's not like a 2fa code where you need to know a secret before verifying you have access to a token (SMS code), it just skips to sending you the code if you have the email or phone number.
- Scoundreller 4y ago
  Yeah, as another poster stated, with a 6 digit code, brute forcing is a likely answer. 1 in a million (or less?) chances to get it right. PayPal has a problem on its hands if it’s unable to see if they’re legit.
  - toast0 4y ago
    Brute forcing like that leaves a lot of data, if PayPal is looking for it.
jabbany 4y ago
Ah, I keep the SMS version of 2FA off and only use the app-based 2FA codes.
0xDEFACED 4y ago
I received one of these a couple days ago and was curious, so I went to paypal’s password recovery to see what it would take to reset my password. I was shocked to see that providing my SSN (which I don’t really consider private) was one of the options. Quickly changed the email on my account and dug around in settings way too long looking to enable 2FA

YVoyiatzis 4y ago

I got one a few months ago, an invoice from a contractor. I did bringing it to PayPal’s attention, as I was fully aware of the dubious attempt. Haven’t heard back, invoice still sitting there awaiting settlement.

arbuge 4y ago

I have noticed these coming in over the last few weeks. Didn't get any before.

Scoundreller 4y ago
And they come from the right short-code as my legitimate requests. Just noticed my legitimate requests are in the form of “PayPal: xxxxxx is your security code. It expires in 10 minutes. Don't share this code with anyone.” But the last one I didn’t request didn’t have an expiration mentioned: “PayPal: xxxxxx is your security code. Don't share your code.”
- brewdad 4y ago
  I have a series of these messages, all legit, that match yours. My most recent message, from about 2 weeks ago, also left out the expiration time but I was logging in at the time so it should be legit as well. No suspicious activity since then, so they may have just shortened up the message.

adrr 4y ago

I get it from outlook.com multiple times a day for a password reset. Assuming a six digit code, they do this 1M times a day across multiple accounts to get around per account throttling, they'll get one success. If they aren't using a secure random number generator, they get increase the probability if they can predict the random number seed.

Scoundreller 4y ago
Coming soon: “Your login code is 8kqhc1abw0v6n11kmdi0py5lwy. Do not share this with anyone”
- TakeBlaster16 4y ago
  "This code will expire in 30 seconds."
- tetha 4y ago
  Stupid idea: Generate ~8 words... and shove them into GPT-3 to create a ~100 word novel, and make that your security code. Suddenly your security code is about a bearded elf, riding a cucumber, wielding a unicorn to defeat ice cream. Try guessing that.

cperciva 4y ago

I've been getting those a lot recently. I assumed it was my phone number being attached to an account which it shouldn't be attached to.

IronWolve 4y ago

Hackers are going through lists of hacked password lists and automated test of each entry, causing tons of gmail/outlook/amazon/paypal/ebay/etc emails. One way to protect yourself is use a different email address, and only for services. Many email sites allow custom addresses, so you can create specific emails addresses for each service. And if your cellphone number is also leaked, get a sms service with a different phone number. https://haveibeenpwned.com https://haveibeenpwned.com and you can do a check on yourself. I find it sad Google sells titan keys but ignores them on login.

MOARDONGZPLZ 4y ago

Just counted, I got 23 of these in the last 30 days. Mostly in bursts. No idea what the deal is.

toast0 4y ago

PayPal offers using SMS to login as a one-time code, without the use of a password. So it's not like a 2fa code where you need to know a secret before verifying you have access to a token (SMS code), it just skips to sending you the code if you have the email or phone number.

Scoundreller 4y ago
Yeah, as another poster stated, with a 6 digit code, brute forcing is a likely answer. 1 in a million (or less?) chances to get it right. PayPal has a problem on its hands if it’s unable to see if they’re legit.
- toast0 4y ago
  Brute forcing like that leaves a lot of data, if PayPal is looking for it.

jabbany 4y ago

Ah, I keep the SMS version of 2FA off and only use the app-based 2FA codes.

0xDEFACED 4y ago

I received one of these a couple days ago and was curious, so I went to paypal’s password recovery to see what it would take to reset my password. I was shocked to see that providing my SSN (which I don’t really consider private) was one of the options. Quickly changed the email on my account and dug around in settings way too long looking to enable 2FA