Flaw in PayPal’s Google Pay integration leading to suspected fraud

Hackers can exploit a virtual credit card within phones to make rogue transactions without authorisation

PayPal users have reported signs of suspicious behaviour on their payment history that originate from their linked Google Pay account, with hackers thought to be exploiting an unknown flaw to commit fraud.

The payment service allows users to make contactless payments via Google Pay on a smartphone, through a virtual credit card which deducts money from their PayPal accounts.

Advertisement - Article continues below

According to a German security researcher, this mechanism is being exploited through an unknown flaw by hackers in order to make fraudulent transactions. 

Streams of users are complaining about mysterious payments appearing on their PayPal payment history, according to German publication Golem, with deductions made ranging between as much as €500 and €1,000. There are also a series of one-cent withdrawals, with hackers likely testing the exploitation to see whether the method works.

The researcher suggested that due to the flaw, anybody near a PayPal user’s phone has access to the virtual credit card that deducts money from their account without authorisation. 

Related Resource

Digital Risk Report 2020

A global view into the impact of digital transformation on risk and security management

Download now

He added that he disclosed the vulnerability to PayPal a year ago, and has followed with disclosure now due to the fact the company apparently hasn’t yet fixed it, despite paying out a fee through its bug bounty programme.

Advertisement - Article continues below

The company, however, told IT Pro that the issue has now been fixed.

Advertisement - Article continues below

Those affected appear to be based largely in Germany, although the fraudulent activity has allegedly been billed to US shops like Target and Starbucks. One user, for example, was charged €923.93 via the virtual credit card in Google Pay, which showed in their history as Target T-1401 in Brooklyn, New York.

"We never lose sight of the fact that we are entrusted to look after people’s money," a PayPal spokesperson told IT Pro.

"The security of customer accounts is a top priority for the company. We use advanced fraud and risk management tools to keep our customers and their payments safe.

"We quickly addressed and fixed this issue, which affected a very small number of PayPal customers using Google Pay in Germany. No personal or financial information was compromised, and no PayPal accounts were accessed by third parties." 

PayPal’s security was previously thrown under the spotlight in 2018 when a teenage hacker revealed he could easily bypass PayPal’s two-step authentication procedure to access user accounts. 

The Australian teen said he was able to bypass the multifactor authentication (MFA) process by spoofing a browser cookie created when users linked their eBay and PayPal accounts together.

Featured Resources

Preparing for long-term remote working after COVID-19

Learn how to safely and securely enable your remote workforce

Download now

Cloud vs on-premise storage: What’s right for you?

Key considerations driving document storage decisions for businesses

Download now

Staying ahead of the game in the world of data

Create successful marketing campaigns by understanding your customers better

Download now

Transforming productivity

Solutions that facilitate work at full speed

Download now


digital currency

MasterCard and Visa abandon support of Facebook's Libra

14 Oct 2019

Most Popular

Google Android

Over two dozen Android apps found stealing user data

7 Jul 2020

How to find RAM speed, size and type

24 Jun 2020

The road to recovery

30 Jun 2020