3 ms·

Paypal Prepaid cards [1] are available instantly at retailers nationwide. You buy a physical card for ~$5 and can do instant PayPal loads of up to $300 each day

Paypal Prepaid cards [1] are available instantly at retailers nationwide. You buy a physical card for ~$5 and can do instant PayPal loads of up to $300 each day with a monthly rolling limit of $2,000. You can literally take these cards to ATM's and get cash. In my experience the non-instant loads - up to $7500 - take less than 24 hours to post to the card even though it says 3-5 business days. So, you buy some Paypal Prepaid cards, activate them and setup PayPal accounts with info bought from hacker forums, transfer money from hacked accounts to the new accounts, and use both the instant and regular Paypal load feature to load the PayPal prepaid cards to get as much cash out as possible. That card as a $940/day ATM limit, so even with 10 or 20 of them you're talking about real money for most of these criminal types. I wouldn't do this obviously, but you asked how someone might take advantage of it. [1] https://paypal.com/prepaid https://paypal.com/prepaid

IkmoIkmo 12y ago
>> USA PATRIOT Act — IMPORTANT INFORMATION ABOUT PROCEDURES FOR OPENING A NEW CARD ACCOUNT: To help the government fight the funding of terrorism and money laundering activities, federal law requires all financial institutions to obtain, verify, and record information that identifies each person who opens a Card Account. What this means for you: When you open a Card Account, we will ask for your name, address, date of birth, and other information that will allow us to identify you. We may also ask to see a copy of your driver's license or other identifying documents. I also wonder if they have some verification on these cards before they're activated. (e.g. the card activation number is sent to your fake address.) It'd definitely be a solid plan IF you could create identifying documents based on stolen identities you can buy online that can fool a 17-year old cashier at a retailer, like an ID card. This is probably not trivial, but very far from impossible. And then use those cards without having to connect them to a verified Paypal account and without needing to activate the card. Nice idea! Would need a ton of prep though if you want to walk away with more than $10k. If I had to choose (as an evil person, say) I'd still take the bounty over this idea.
- downandout 12y ago
  You can buy the cards at retail with no ID at all. When you get home, you need to activate the card online. To do that all you need is a valid DOB/SSN/address/name combination (checked against credit header file info). They only ask for copies of ID's etc. if their online activation system can't automatically verify the info through the credit bureaus. Fortunately, full profiles with this info are available on the cheap on Russian hacker forums (less than $5 per record). They do send a permanent card in the mail about 10 days after activation, but the temporary one bought in the store and activated online is all you need to take cash from ATM's. By the time the permanent card arrived at the address you used to activate it, you would have long been done using the account.
  - IkmoIkmo 12y ago
    Wow, seems pretty fool-proof then. Always thought even if you could grab a Paypal account, the damage you could do would be pretty limited due to reversible transactions, payout to the user's bank account only, limited ways to buy high value online goods instantly etc. I wonder how successful their card program is and what percentage of their fraud is generated by it. We're seeing businesses massively shift away from cash, as are governments. But I also thought the same was happening with cards to a smaller extent. Wouldn't have expected a physical-card push from a digital money company like Paypal. I guess cards (physical or stored as digital credentials like Appe Pay) are here to stay for quite some time.

IkmoIkmo 12y ago

>> USA PATRIOT Act — IMPORTANT INFORMATION ABOUT PROCEDURES FOR OPENING A NEW CARD ACCOUNT: To help the government fight the funding of terrorism and money laundering activities, federal law requires all financial institutions to obtain, verify, and record information that identifies each person who opens a Card Account. What this means for you: When you open a Card Account, we will ask for your name, address, date of birth, and other information that will allow us to identify you. We may also ask to see a copy of your driver's license or other identifying documents. I also wonder if they have some verification on these cards before they're activated. (e.g. the card activation number is sent to your fake address.) It'd definitely be a solid plan IF you could create identifying documents based on stolen identities you can buy online that can fool a 17-year old cashier at a retailer, like an ID card. This is probably not trivial, but very far from impossible. And then use those cards without having to connect them to a verified Paypal account and without needing to activate the card. Nice idea! Would need a ton of prep though if you want to walk away with more than $10k. If I had to choose (as an evil person, say) I'd still take the bounty over this idea.

downandout 12y ago
You can buy the cards at retail with no ID at all. When you get home, you need to activate the card online. To do that all you need is a valid DOB/SSN/address/name combination (checked against credit header file info). They only ask for copies of ID's etc. if their online activation system can't automatically verify the info through the credit bureaus. Fortunately, full profiles with this info are available on the cheap on Russian hacker forums (less than $5 per record). They do send a permanent card in the mail about 10 days after activation, but the temporary one bought in the store and activated online is all you need to take cash from ATM's. By the time the permanent card arrived at the address you used to activate it, you would have long been done using the account.
- IkmoIkmo 12y ago
  Wow, seems pretty fool-proof then. Always thought even if you could grab a Paypal account, the damage you could do would be pretty limited due to reversible transactions, payout to the user's bank account only, limited ways to buy high value online goods instantly etc. I wonder how successful their card program is and what percentage of their fraud is generated by it. We're seeing businesses massively shift away from cash, as are governments. But I also thought the same was happening with cards to a smaller extent. Wouldn't have expected a physical-card push from a digital money company like Paypal. I guess cards (physical or stored as digital credentials like Appe Pay) are here to stay for quite some time.