iTunes+PayPal -> fake charges

Earlier this week, I used iTunes to buy a single and found a new link to support PayPal payment. I prefer PayPal instead of the credit card to I took it . . . BAD MOVE.

Two days later, two separate iTunes payments for $40 and $46, fraudlent charges against my PayPal account. So I contacted Apple and they refunded the money. I also changed both the iTunes and PayPal passwords . . . first time in over a year.

This morning at 3:00 AM, another iTunes payment for $16.00. This time I found my iTunes account frozen (GOOD!) I contacted Apple and got a refund but when I went into PayPal, I was able to disable the "iTunes billing agreement." (VERY GOOD!)

The Apple tech believes the $16 charge had been submitted before I first contacted them about the $40 and $46 charge. . . . must have been one of those old computers. Regardless, lessons learned.

"Phishing scam" - H*LL NO! This came from iTune (V10) offering a PayPal payment link. This is an Apple-to-PayPal problem.

I don't know how it was hacked but it happened so . . . deal with it. I'm just offering a 'heads up' to avoid the problem I ran into.

Bob Wilson

 

Well let's look at the evidence:

	Column 1	Column 2	Column 3	Column 4
0	Oct 23	2010	Payment To iTunes Store Refunded	-$16.07 USD
1	Oct 19	2010	Payment To iTunes Store Refunded	-$40.92 USD
2	Oct 19	2010	Payment To iTunes Store Refunded	-$49.34 USD
3	Oct 18	2010	Payment To iTunes Store Completed	-$1.06 USD

The last 7 days activity from my PayPal account.

So let's assume an ordinary criminal got my PayPal password. Their first action is to buy music from iTunes, not 'gold coins', jewels, or precious gems because this criminal really, really wants some music.

Now between Oct 19 and Oct 23, I changed the PayPal password. So the criminal somehow gets that password and once again, they're at the iTunes Store buying music. Thank God they didn't find some Nigerian bank offer to chase down a fondness for GM products!

On Oct. 23, I turned off the PayPal "business" relationship to iTunes. You are of course welcome to test it but I've had enough.

Bob Wilson

 

I disagree which is why when reading the August articles claiming it was "PHISHING," I realized that it was just more 'blame the victim' nonsense and lazy journalism. I don't know how the iTunes-to-PayPal link got compromised and in truth, I could get in a lot more trouble trying to diagnose it. I'm not that into doing the Apple/PayPal work.

I'm not worried about the iTunes account as it is now 'disabled.' I had changed the password. Now all passwords are disabled with the account.

Yes, I'll eventually find something to buy via iTunes in the future but it will be a different account. I'll probably buy one of the pre-paid cards and be done with it. No more credit cards or PayPal paying for iTunes stuff. Still, I encourage the skeptics . . . those who doubt my word . . . do the experiment. <grins> Hummmm, there are two characters on my "Ignore User" list . . .

Bob Wilson

 

History:

• Oct 18 - upon hearing about Julie Brown's "Big Clown Pants" on the Stephanie Miller show, I opened up iTunes and looked at Julie's body of work. It looked like "Big Clown Pants" was the single most popular of her tunes and I wasn't interested in the others. So as I went to pay for the tune, I saw the PayPal option, something I had not seen before. Since I have a lot of confidence in PayPal for my Ebay purchases, I thought 'Why not' and selected it. I didn't record the exact sequences at the time because there was no reason to be alarmed. I trusted iTunes and PayPal and this looked to be a better way to avoid having a credit card in the middle. The song downloaded and on my iPod and I had a good laugh driving into work and playing for some co-workers ("Big Clown Pants" is a derivative work of Lady Gagga with a little, blue satire. Just a touch too racy to share with most women.)
• Oct 19 - two fraudulent charges on my iTunes account using the PayPal payment. I spied the charges on Oct. 20th on my PayPal e-mail account and then checked the different e-mail, iTunes account. I contacted Apple about the problem and changed the passwords on both the iTunes and PayPal accounts. The refunds from Apple iTunes were rapid and came in even as I was in a 'chat' session with the Apple iTunes help desk person.
• Oct 23 - third fraudulent charge on my iTunes account found within 45 minutes via an e-mail on the iTunes account. The PayPal notice had yet to show up but did a couple of hours later. I contacted the Apple iTunes staff and they explained 'may take 3-5 business days' for some business transactions to clear and this one was done about the same time as the earlier two. Regardless, iTunes refunded the money and enabled my account (again!) with instructions on how to disable the PayPal option. I changed the iTunes password again and disabled all payment options. I also found an option under PayPal to disable the iTunes "business" relationship (whatever the heck that means.)

Please understand I had not 'changed my passwords' for either iTunes nor PayPal in the previous year. There was no PHISHing compromise. Please put that chestnut in the same pot with having rape victims pay for their own rape kit or being forced to carry to term a rapist fetus. Of the many articles published in August about this iTunes-PayPal fraud, claiming this was PHISHing is the most hurtful, mean and despicable lie floated by those who claimed or echoed that lazy nonsense.

Rather, let me suggest the following:

Do the experiment​

Go to your iTunes account and enable "PayPal" to buy a tune. Monitor it for a week or so and see if your account also shows fraudulent charges. I've done it and would love to hear exactly what you did and the results. As for my configuration:

• iTunes version 10
• MacOS V10.5.8
• T-mobile Rocket USB network access

It may be this is unique to this Mac user on a T-mobile network. Who knows, I may have a keycaps capture program running (and I'm checking using 'tcpdump'.) Having worked in network security, I'm not perfect but few have called me lazy.

Seriously, if you want to investigate the vulnerability, repeat the experiment and take good notes. I would be happy to find someone who does not see this problem or even the happy case that the problem has been found and fixed. But I fear no one from Apple nor PayPal is going to let us know that this problem has been diagnosed and/or fixed. I say that because I've had two sessions with iTunes support staff and they have not volunteered that it is a know problem even though I asked. I have not had to take it to PayPal but their system prompted me to terminate the "business relationship."

Bob Wilson

 

Sad to say, I don't remember exactly the sequence. I vaguely remember a new window popping up after the iTunes click for a PayPal option. I'm sure the PayPal password was needed but I really don't remember which window prompted for it. Regardless, this is not an experiment I look forward to repeating.

Everything started from a PayPal option available via iTunes. How the iTunes software led to the problem is an iTune-PayPal problem, not mine. I'm just sharing my tale of woe and folks are welcome to ignore or take it as a cautionary tale. Time for others to do 'the heavy lifting.'

Bob Wilson

 

Ok, you win. You want me to go back and edit all of my earlier postings to 'nothing?' That would be the 'responsible' thing? No my friend, that would exceptionally foolish.

You have just advocated a robbery victim be quiet and not report what happened. These are just the facts and data to the best of my memory. Since you've had a different experience, how about sharing some configuration details:

• operating system
• version of iTunes when you selected the PayPal option
• when this was done - I noticed a rash of news reports around August 23 of the iTunes-PayPal fraudulent charges . . . as if something happened this summer

As a famous American once said, 'Those who are not part of the solution are part of the problem.'

Bob Wilson