4 ms·
The attacker was posing as a PayPal employee, not the card owner. Of course, PayPal still needs better security, but posing as an employee of the same company i
by autarch 13y ago
The attacker was posing as a PayPal employee, not the card owner. Of course, PayPal still needs better security, but posing as an employee of the same company is a classic social engineering exploit.
- Aqueous 13y agoAnd that part was never really answered either. How can he pose as an employee calling in from an outside line? Does PayPal not tell you when an extension from PayPal is calling you?
- phpnode 13y agohe was probably posing as an employee of the account holder, not paypal
- xauronx 13y agoOhh, good point. I never thought of that. I assumed employee of Twitter as well.
- baddox 13y agoWho cares what number the call was coming from. Security 101 for these phone techs should say something like "don't give out any information over the phone, even if the CEO calls and threatens to fire you if you don't." Or better yet, have much stricter protocols that deny the phone tech access to the information, so even if the caller threatens the tech personally, the information is safe.