PayPal users can endlessly double their money because of a loophole in the payment company’s protection policy, according to a security consultant.
Discovered by Razvan Cernaianu, chief operating officer at Cyber Smart Defence, the exploit uses the chargeback function used for reversing a cleared transaction if fraud is suspected by the buyer.
To exploit this a fraudster needs three PayPal accounts. One is a legitimate buyer, another is a disposable seller and the third is a mule. The latter accounts would be linked to virtual credit cards.
“You transfer the money to the second account with the pretext of buying a phone. From the second account you again transfer the money to the third account as a gift. After 24 hours, you use the chargeback function from the first account to get the money back with the excuse that the phone did not arrive on time,” Cernaianu explained.
“As the second account is only a virtual one, it will not have real money from which Paypal can extract. Therefore you are left with $500 restored by PayPal, and $500 in your third account.”
Razvan Cernaianu has since reported this vulnerability to the Paypal bug bounty program
