Flaw in PayPal’s Google Pay integration leading to suspected fraud

Hackers can exploit a virtual credit card within phones to make rogue transactions without authorisation

PayPal users have reported signs of suspicious behaviour on their payment history that originate from their linked Google Pay account, with hackers thought to be exploiting an unknown flaw to commit fraud.

The payment service allows users to make contactless payments via Google Pay on a smartphone, through a virtual credit card which deducts money from their PayPal accounts.

According to a German security researcher, this mechanism is being exploited through an unknown flaw by hackers in order to make fraudulent transactions. 

Streams of users are complaining about mysterious payments appearing on their PayPal payment history, according to German publication Golem, with deductions made ranging between as much as €500 and €1,000. There are also a series of one-cent withdrawals, with hackers likely testing the exploitation to see whether the method works.

The researcher suggested that due to the flaw, anybody near a PayPal user’s phone has access to the virtual credit card that deducts money from their account without authorisation. 

Related Resource

Digital Risk Report 2020

A global view into the impact of digital transformation on risk and security management

Download now

He added that he disclosed the vulnerability to PayPal a year ago, and has followed with disclosure now due to the fact the company apparently hasn’t yet fixed it, despite paying out a fee through its bug bounty programme.

The company, however, told IT Pro that the issue has now been fixed.

Those affected appear to be based largely in Germany, although the fraudulent activity has allegedly been billed to US shops like Target and Starbucks. One user, for example, was charged €923.93 via the virtual credit card in Google Pay, which showed in their history as Target T-1401 in Brooklyn, New York.

"We never lose sight of the fact that we are entrusted to look after people’s money," a PayPal spokesperson told IT Pro.

"The security of customer accounts is a top priority for the company. We use advanced fraud and risk management tools to keep our customers and their payments safe.

"We quickly addressed and fixed this issue, which affected a very small number of PayPal customers using Google Pay in Germany. No personal or financial information was compromised, and no PayPal accounts were accessed by third parties." 

PayPal’s security was previously thrown under the spotlight in 2018 when a teenage hacker revealed he could easily bypass PayPal’s two-step authentication procedure to access user accounts. 

The Australian teen said he was able to bypass the multifactor authentication (MFA) process by spoofing a browser cookie created when users linked their eBay and PayPal accounts together.

Featured Resources

Navigating the new normal: A fast guide to remote working

A smooth transition will support operations for years to come

Download now

Leading the data race

The trends driving the future of data science

Download now

How to create 1:1 customer experiences at scale

Meet the technology capable of delivering the personalisation your customers crave

Download now

How to achieve daily SAP releases

Accelerate the pace of SAP change to support your digital strategy

Download now

Recommended

MasterCard and Visa abandon support of Facebook's Libra
digital currency

MasterCard and Visa abandon support of Facebook's Libra

14 Oct 2019

Most Popular

Microsoft hints at stand-alone successor to Office 2019 suite
Microsoft Office

Microsoft hints at stand-alone successor to Office 2019 suite

24 Sep 2020
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020