4 ms·

> The company also said it has no evidence of unauthorized access or compromises to personal or financial information for PayPal users. PayPal data is stored s

> The company also said it has no evidence of unauthorized access or compromises to personal or financial information for PayPal users. PayPal data is stored separately on a secure network, and all PayPal financial information is encrypted. Ebay being hacked kind of scares the hell out of me because PayPal has my checking account information with direct access to withdraw funds. A hacker could rob me blind. Like seriously the owner of PayPal should not be telling me this "we have no evidence of" bullshit because there's no alternative to PayPal that online stores actually use and changing your checking account number and routing number is very very painful. You have to get new checks, you lose checking history. Fuck.

archon 12y ago
I know it's not always practical for everyone, so I can't give it as general advice, but this kind of situation is exactly why I isolate my "real" checking account. My primary account (the one to which my paychecks are deposited) doesn't have a debit card, and I never use the account number. I have a different account that I use for online services like PayPal, and for recurring charges online that require a credit/debit card, which I transfer money into on demand. It's extra work for me, but it's also less risk. Unless somebody gains access to my online banking account, they're not going to be able to access my primary funds account.
- bentcorner 12y ago
  This is also sort of how I operate. I have one checking account that my paycheck goes into, and I pay monthly/yearly recurring bills out of this account. There is nothing online for this account, the only way money gets out is that I get my bank to send somebody a check. I set up a weekly auto-transfer to a separate account which my wife and I carry around debit cards for. This is for groceries, gas, and personal shopping stuff, including online.
  - vhost- 12y ago
    Are your accounts with two separate banks? Last time I tried to open another account with a separate bank, I got denied because I opened an account within the past year.
    - bentcorner 12y ago
      It's with the same bank. I got another debit card for it but keep in stored away and never use it.
    - ars 12y ago
      Not the OP but I do the same - two accounts, one for PayPal, and my real one. It's two checking accounts in the same bank. Just call your bank and ask them to make you another account. With my bank I don't even have to call them, I can make one from the account page. By having it in the same bank I can leave the PayPal account always at 0, and transfer the money easily to the other account.
      - jacquesm 12y ago
        Make sure that second account has a flag that says it can not be overdrawn under any circumstances. Banks are not always as smart as they should be and sometimes allow an account of a customer 'in good standing' or with a credit balance on another account to be overdrawn. Especially when it is done via direct debit. This sort of thing can really bite you.
  - bentcorner 12y ago
    Also, the primary reason was to help us balance our budget. I've tried software to do it, but: a) My wife isn't into tech as much as I am and has a much lower threshold for acceptable complexity b) More importantly, any software that I found had a large maintenance burden. Having her ask "do we have enough to go to dinner tonight?" requires me to have the books up-to-date almost on a daily basis. Too much work. Now, the question of how much do we have to spend for specific activities has a very simple answer: how much is in the "spending" bank account, and it's easy to prorate that over a week's time. A previous attempt at this was over a month's time frame, but that's too long of a time span. It's easy to overspend earlier in the month and fail to mentally take into account bigger things near the end of the month. I also tried being "squishy" with the amount, moving it around depending on how much we overspent for the previous week (e.g., put something on our credit card because we actually needed to). This also doesn't work out too well, because it impairs predictability, even if it balances the books better. Plus, I want to get us off the mindset of using the credit card when we overspend a week. I was, frankly, being a tightwad with the weekly amounts and loosened it up a little to give us a bit more buffer. Setting a weekly fixed amount made our money conversations easier. I'm still undoing financial damage from earlier (paying off credit card debt and building up savings for yearly bills), but this is an abstraction my wife doesn't need to worry about (she knows about it but doesn't need to deal with it). This was all tangential to protecting yourself from badness, but it was a nice side effect.
- simplestyle 12y ago
  For those of us who don't have this setup, suppose this kind of breach does occur and money is taken from a checking account. Is this covered by the bank somehow? Can that money be returned?
  - leorocky 12y ago
    Depends on the bank, but it's definitely not protected by law the way a credit card is, at least in the US. That goes for debit cards too by the way.
    - schrodinger 12y ago
      I've had my debit card used at least half a dozen time by thieves (they must skim the magnetic information off it at gas stations or something), including a thousand dollar charge at an ATM while I was abroad. In every case Chase refunded me in full within a few days. This isn't something every bank does?
  - danielweber 12y ago
    In the US, consumer level accounts are protected against unauthorized withdrawals. (The bottleneck for the crooks is finding a sucker who will change a reversible transaction into an irreversible transaction.) It might take you some time to get it back, but the bank is legally required to get it back to you. For business accounts this protection does not apply.
mnw21cam 12y ago
Okay, so let's imagine for a moment that the "secure, encrypted" database of card numbers has also been compromised. The attacker would have the plaintext name and address, and an encrypted 16 digit number, with an entropy of at most 53 bits - maybe 66 bits if the expiry date is included. That's before you take card number check digits and geographically-likely prefix codes into account, which will reduce the entropy. (Edit: yes, they wouldn't store the CVV). And don't get me started on showing the user the last four digits of the card number. It wouldn't take much effort in this day and age for the attacker to try all possible card numbers, and then they have name, address, and card number. Game over, man. Wouldn't it be possible for them instead to store a token generated from the card number and Ebay/Paypal's incoming bank account number, which can only be used for paying into that particular account?
- mikeash 12y ago
  But what does it matter if they figure out your card number? You're not liable for fraudulent transactions. It's pretty easy to get a new card number. Your issuer takes a hit, but whatever, not my problem. Checking account info is much, much worse. It's much harder to reverse fraudulent transactions there, and much harder to get a new number.
  - mnw21cam 12y ago
    It can still be very inconvenient.
    - mikeash 12y ago
      It really shouldn't be. I had a card compromised in the Target breach and they sent me a new one without my intervention. I've had fraudulent charges made before, and it's been trivial to get it fixed. I've never had a checking account compromise, but I'm pretty sure it would be a massive pain in the ass by comparison.
      - schrodinger 12y ago
        Mentioned above, but relevant here too. I've had my debit card compromised several times, and it was still trivial - one phone call and was refunded in a few days.
panarky 12y ago
If ebay is spinning this, burying the lede, minimizing the real severity, eventually the truth will be known. So I'm trying an arbitrage trade. Just sold short ebay at 51.62 and hedged by buying amzn at 305.44. If this is more serious than the press release indicates, ebay should deteriorate relative to amzn.
matwood 12y ago
Not practical when you want to pull money out, but I only have paypal hooked up to my CC. This very reason is why I never hooked it up to my bank account. When I do get people who paypal me money, which is not often, I just use the money to load my sbux card or something. Obviously this is harder to do if you are a merchant who takes large amounts of money through paypal. In those cases though the merchant should have already segmented the paypal hooked bank account from the primary business account. If you are a merchant and have not done this, now is a good time.
anujnayar 12y ago
Hi - PayPal was not affected. Info on and an FAQ for eBay users is here. https://info.ebayinc.com https://info.ebayinc.com
woobar 12y ago
Thanks for reminding about this. I was using a separate checking account just for Paypal. Until they "restricted" my PP account. Since I've stopped using PayPal now I keep some money on that checking account. Went to update my profile... 1. You cannot remove a primary credit card from your profile. There is only one option "Edit" where you can change expiration date and Billing Address. Entering incorrect expiration date does not work. It only allowed me to change billing address. 2. Removing checking account is not confirmed. Once I've clicked "Remove" button I was redirected to login screen. Now when I try to access my bank account I am signed out and redirected to login. I hate calling them, but looks like that's my only option.

archon 12y ago

I know it's not always practical for everyone, so I can't give it as general advice, but this kind of situation is exactly why I isolate my "real" checking account. My primary account (the one to which my paychecks are deposited) doesn't have a debit card, and I never use the account number. I have a different account that I use for online services like PayPal, and for recurring charges online that require a credit/debit card, which I transfer money into on demand. It's extra work for me, but it's also less risk. Unless somebody gains access to my online banking account, they're not going to be able to access my primary funds account.

bentcorner 12y ago
This is also sort of how I operate. I have one checking account that my paycheck goes into, and I pay monthly/yearly recurring bills out of this account. There is nothing online for this account, the only way money gets out is that I get my bank to send somebody a check. I set up a weekly auto-transfer to a separate account which my wife and I carry around debit cards for. This is for groceries, gas, and personal shopping stuff, including online.
- vhost- 12y ago
  Are your accounts with two separate banks? Last time I tried to open another account with a separate bank, I got denied because I opened an account within the past year.
  - bentcorner 12y ago
    It's with the same bank. I got another debit card for it but keep in stored away and never use it.
  - ars 12y ago
    Not the OP but I do the same - two accounts, one for PayPal, and my real one. It's two checking accounts in the same bank. Just call your bank and ask them to make you another account. With my bank I don't even have to call them, I can make one from the account page. By having it in the same bank I can leave the PayPal account always at 0, and transfer the money easily to the other account.
    - jacquesm 12y ago
      Make sure that second account has a flag that says it can not be overdrawn under any circumstances. Banks are not always as smart as they should be and sometimes allow an account of a customer 'in good standing' or with a credit balance on another account to be overdrawn. Especially when it is done via direct debit. This sort of thing can really bite you.
- bentcorner 12y ago
  Also, the primary reason was to help us balance our budget. I've tried software to do it, but: a) My wife isn't into tech as much as I am and has a much lower threshold for acceptable complexity b) More importantly, any software that I found had a large maintenance burden. Having her ask "do we have enough to go to dinner tonight?" requires me to have the books up-to-date almost on a daily basis. Too much work. Now, the question of how much do we have to spend for specific activities has a very simple answer: how much is in the "spending" bank account, and it's easy to prorate that over a week's time. A previous attempt at this was over a month's time frame, but that's too long of a time span. It's easy to overspend earlier in the month and fail to mentally take into account bigger things near the end of the month. I also tried being "squishy" with the amount, moving it around depending on how much we overspent for the previous week (e.g., put something on our credit card because we actually needed to). This also doesn't work out too well, because it impairs predictability, even if it balances the books better. Plus, I want to get us off the mindset of using the credit card when we overspend a week. I was, frankly, being a tightwad with the weekly amounts and loosened it up a little to give us a bit more buffer. Setting a weekly fixed amount made our money conversations easier. I'm still undoing financial damage from earlier (paying off credit card debt and building up savings for yearly bills), but this is an abstraction my wife doesn't need to worry about (she knows about it but doesn't need to deal with it). This was all tangential to protecting yourself from badness, but it was a nice side effect.
simplestyle 12y ago
For those of us who don't have this setup, suppose this kind of breach does occur and money is taken from a checking account. Is this covered by the bank somehow? Can that money be returned?
- leorocky 12y ago
  Depends on the bank, but it's definitely not protected by law the way a credit card is, at least in the US. That goes for debit cards too by the way.
  - schrodinger 12y ago
    I've had my debit card used at least half a dozen time by thieves (they must skim the magnetic information off it at gas stations or something), including a thousand dollar charge at an ATM while I was abroad. In every case Chase refunded me in full within a few days. This isn't something every bank does?
- danielweber 12y ago
  In the US, consumer level accounts are protected against unauthorized withdrawals. (The bottleneck for the crooks is finding a sucker who will change a reversible transaction into an irreversible transaction.) It might take you some time to get it back, but the bank is legally required to get it back to you. For business accounts this protection does not apply.

mnw21cam 12y ago

Okay, so let's imagine for a moment that the "secure, encrypted" database of card numbers has also been compromised. The attacker would have the plaintext name and address, and an encrypted 16 digit number, with an entropy of at most 53 bits - maybe 66 bits if the expiry date is included. That's before you take card number check digits and geographically-likely prefix codes into account, which will reduce the entropy. (Edit: yes, they wouldn't store the CVV). And don't get me started on showing the user the last four digits of the card number. It wouldn't take much effort in this day and age for the attacker to try all possible card numbers, and then they have name, address, and card number. Game over, man. Wouldn't it be possible for them instead to store a token generated from the card number and Ebay/Paypal's incoming bank account number, which can only be used for paying into that particular account?

mikeash 12y ago
But what does it matter if they figure out your card number? You're not liable for fraudulent transactions. It's pretty easy to get a new card number. Your issuer takes a hit, but whatever, not my problem. Checking account info is much, much worse. It's much harder to reverse fraudulent transactions there, and much harder to get a new number.
- mnw21cam 12y ago
  It can still be very inconvenient.
  - mikeash 12y ago
    It really shouldn't be. I had a card compromised in the Target breach and they sent me a new one without my intervention. I've had fraudulent charges made before, and it's been trivial to get it fixed. I've never had a checking account compromise, but I'm pretty sure it would be a massive pain in the ass by comparison.
    - schrodinger 12y ago
      Mentioned above, but relevant here too. I've had my debit card compromised several times, and it was still trivial - one phone call and was refunded in a few days.

panarky 12y ago

If ebay is spinning this, burying the lede, minimizing the real severity, eventually the truth will be known. So I'm trying an arbitrage trade. Just sold short ebay at 51.62 and hedged by buying amzn at 305.44. If this is more serious than the press release indicates, ebay should deteriorate relative to amzn.

matwood 12y ago

Not practical when you want to pull money out, but I only have paypal hooked up to my CC. This very reason is why I never hooked it up to my bank account. When I do get people who paypal me money, which is not often, I just use the money to load my sbux card or something. Obviously this is harder to do if you are a merchant who takes large amounts of money through paypal. In those cases though the merchant should have already segmented the paypal hooked bank account from the primary business account. If you are a merchant and have not done this, now is a good time.

anujnayar 12y ago

Hi - PayPal was not affected. Info on and an FAQ for eBay users is here. https://info.ebayinc.com https://info.ebayinc.com

woobar 12y ago

Thanks for reminding about this. I was using a separate checking account just for Paypal. Until they "restricted" my PP account. Since I've stopped using PayPal now I keep some money on that checking account. Went to update my profile... 1. You cannot remove a primary credit card from your profile. There is only one option "Edit" where you can change expiration date and Billing Address. Entering incorrect expiration date does not work. It only allowed me to change billing address. 2. Removing checking account is not confirmed. Once I've clicked "Remove" button I was redirected to login screen. Now when I try to access my bank account I am signed out and redirected to login. I hate calling them, but looks like that's my only option.