HELP!! Email hacked, then eBay hacked and Rolex bought in my name - now Paypal say they can't help?

BristolBoy33

As per the title.  I couldn't receive any emails for a period in early June - finally discovered that my emails had been diverted.  I removed the diversion, and changed the password.  All was good for a few days, then emails stopped arriving again.  Virgin Media said it was a known problem, and to wait to give them time to resolve it.  That turned out to be rubbish, because I finally resolved it (can't remember how, due to CV19, old age, and other things going wrong all at once!!).  So emails were fine again.

THEN I received my monthly credit card statement showing a £3500 payment to Paypal.  After much digging I discovered that someone had hacked my eBay account and bought an expensive Rolex watch.  My eBay account shows the watch being sent to my home address, but the Royal Mail tracking info shows it was delivered to an address in North London (150 miles from where I live).  Interestingly, the "purchase" does not appear anywhere on my list of purchases - I got the tracking number from the Order.
I spoke to my credit card company, who put a hold on the account, and they suggested I dispute the charge with Paypal in the first instance.  Paypal have just now refused to reimburse me because there was no "unauthorised use" of my account - which is technically true, because the scam was on my eBay account - but I'm cross with them because they don't seem to have a system in place to highlight 'unusual' transactions, in the way that credit card companies do.

So where do I go from here?  Are Paypal at fault for just blindly paying the amount to the seller without checking with me somehow? Or do I go to eBay and ask them to sort it? And where does my credit card company (Nat West Bank) stand in this - are they ultimately liable if I can convince them that I am the innocent party in all this?

Any advice would be very gratefully received, as my wife and I cannot afford to pay the £3500 and are worried sick about it.  Being trapped indoors due to Covid doesn't help either!!

soolin

Paypal are not at fault, it looks like your email has been hacked and your ebay and paypal so this is a serious problem and you need firstly to ensure that anything malicious on your PC has been dealt with - try the tech board on here and ask about a deep clean.The other option is possibly someone close to you has had access to your details and used that to divert your email and took it from there. This is a pretty failure of security and is going to be difficult to get anything back from unfortunately.

QUOTE: My eBay account shows the watch being sent to my home address, but the Royal Mail tracking info shows it was delivered to an address in North London (150 miles from where I live).  Interestingly, the "purchase" does not appear anywhere on my list of purchases.

someone with full access to your ebay account can easily hide or delete purchases - but you must be able to see it somewhere if you can get the tracking from 'your ebay order'.

The only way to get your money back is to prove this is an unauthorised transaction - and you might need to be very persistent. The fact that you lost control of all your finances and email account is going to make this difficult. Try again with a charge back for unauthorised use , insist that the full history of this transaction is investigated and due to the money it might be possible to even get this notified to the Police and get a crime number. My worry though is why they turned down the fraud claim so easily- have they mentioned anything about the hacker using third party authorisation on your accounts, same IP address, anything like that?

Quote: Are Paypal at fault for just blindly paying the amount to the seller without checking with me somehow?

payment details would have shown in your account and by email to you , that is their notification. There would also have been a delay in payment being made and actually taken from your account- paypal, as far as I know, communicate only via their account or by email, they don't have any facility to phone customers. 

BristolBoy33

Thanks very much soolin.

I've already done a full scan of my computer, and changed passwords.  Only myself and my wife have access to my devices, so there is no possibility that this was down to someone close to me.

It was my email that was hacked, and then my eBay.  Once the fraudulent purchase was made, Paypal (as the payment method linked to my eBay account) merely paid the eBay seller as usual.  Given that, at that point, my emails were being diverted, I would not have received any warning emails that Paypal might (or might not!) have sent me.  I went straight to Paypal on the suggestion of my credit card company but, to be fair to the card company they did say to get back to them if Paypal refused my claim.

"someone with full access to your ebay account can easily hide or delete purchases - but you must be able to see it somewhere if you can get the tracking from 'your ebay order'."
I received an eBay order update on 27th June, telling me to expect my item on 15th June (??).  This was the only place I could view the order details and drill down to get the tracking details - there is nothing in My eBay.

"The only way to get your money back is to prove this is an unauthorised transaction - and you might need to be very persistent. The fact that you lost control of all your finances and email account is going to make this difficult. Try again with a charge back for unauthorised use , insist that the full history of this transaction is investigated and due to the money it might be possible to even get this notified to the Police and get a crime number. My worry though is why they turned down the fraud claim so easily- have they mentioned anything about the hacker using third party authorisation on your accounts, same IP address, anything like that?"
When Paypal replied to me it was basically a one-liner:  "This decision was made because this transaction was not unauthorised." There was no mention of the hacker using third party authorisation, or the same IP address - nothing apart from the one liner.  I am currently waiting for Paypal to get back to me with a manager's name and phone number - but I'm not holding my breath for that!!  I'll give them a few more hours to reply, then I'll message them more strongly, insisting that they investigate the full history.  I've just spoken to the Police, and they just referred me to Action Fraud - who I have already notified - but I may mention them to Paypal anyway.

Thanks again for your time.

soolin

quote;  It was my email that was hacked, and then my eBay

this is what worries me, they got access to your email and ebay - which means that somehow you either gave them both log in details via a phish (and to fall for one twice would be unusual) or someone has a key logger type of virus on your PC that a straight scan hasn't located or someone close to you (not necessarily in same house) has guessed your passwords.

Your battle is to convince the bank and paypal that this was not you scamming, at the moment all they can see is that someone logged into your ebay and also into your emails to divert all the notifications and emails from ebay and paypal. Banks do not have to reimburse users if money was lost due to wilful negligence (I'm sorry there is a proper term for this but I don't know it) so knowing how this happened might assist your argument. meanwhile you need to concentrate on the unauthorised use aspect . Have you tried seeing if the Police will give you a crime number as this might help?

One other angle is the Virgin Media issue, I might be on a wild goose chase purely because I am having issues with them and their misinformation about current down time issues- but will they confirm in writing that for some reason you had no access to your emails and this fault was recorded by them? I'm probably running away with daft ideas here, but if they will confirm that for a while you had no access to your emails - and even commit to say that a third party was involved I wonder if it might help your case?

[Deleted User]

1. Report it to the police with the Royal Mail tracking number and the address of where it was delivered. Action Fraud is the most useless team and you will never hear from them again. 
2. Report it as fraud to Natwest. This is your best chance at getting your money back and Natwest can request details (IP addresses, device names, etc.) from eBay and PayPal.
3. Report it to eBay and the eBay seller. 

I don't understand how they used your PayPal. Was your PayPal password the same as your email password?

[Deleted User]

soolin said:

quote;  It was my email that was hacked, and then my eBay

this is what worries me, they got access to your email and ebay - which means that somehow you either gave them both log in details via a phish (and to fall for one twice would be unusual) or someone has a key logger type of virus on your PC that a straight scan hasn't located or someone close to you (not necessarily in same house) has guessed your passwords.

Your battle is to convince the bank and paypal that this was not you scamming, at the moment all they can see is that someone logged into your ebay and also into your emails to divert all the notifications and emails from ebay and paypal. Banks do not have to reimburse users if money was lost due to wilful negligence (I'm sorry there is a proper term for this but I don't know it) so knowing how this happened might assist your argument. meanwhile you need to concentrate on the unauthorised use aspect . Have you tried seeing if the Police will give you a crime number as this might help?

One other angle is the Virgin Media issue, I might be on a wild goose chase purely because I am having issues with them and their misinformation about current down time issues- but will they confirm in writing that for some reason you had no access to your emails and this fault was recorded by them? I'm probably running away with daft ideas here, but if they will confirm that for a while you had no access to your emails - and even commit to say that a third party was involved I wonder if it might help your case?

I doubt it is a phish or keylogger. Their details were probably part of a database leak and they reused some passwords. Check: haveibeenpwned.com

What does Virgin Media have to do with this? The ISP does not know whether or not they had access to their email. 

soolin

throwaway3000 said:

1. Report it to the police with the Royal Mail tracking number and the address of where it was delivered. Action Fraud is the most useless team and you will never hear from them again. 
2. Report it as fraud to Natwest. This is your best chance at getting your money back and Natwest can request details (IP addresses, device names, etc.) from eBay and PayPal.
3. Report it to eBay and the eBay seller. 

I don't understand how they used your PayPal. Was your PayPal password the same as your email password?

It is possible to link your paypal direct to ebay and do away with any need for passwords, it is called faster payments and recommended for frequent users to avoid keep logging in and can be used to pay for ebay purchases. The confusing thing here is that there is the issue that the address in paypal was left unchanged - yet parcel was diverted and that is an entirely different scenario which suggests this scam goes further than perhaps the OP has intimated.

As it stands there are possibly two scams going on here and that might be why the bank and paypal are reluctant to see the scam.

[Deleted User]

soolin said:

It is possible to link your paypal direct to ebay and do away with any need for passwords, it is called faster payments and recommended for frequent users to avoid keep logging in and can be used to pay for ebay purchases. The confusing thing here is that there is the issue that the address in paypal was left unchanged - yet parcel was diverted and that is an entirely different scenario which suggests this scam goes further than perhaps the OP has intimated.

As it stands there are possibly two scams going on here and that might be why the bank and paypal are reluctant to see the scam.

Oh, I didn't think about that. 

If the item was delivered to the wrong address, can eBay not issue a refund? 

In any case, I believe Natwest is the best chance at a refund. 

soolin

throwaway3000 said:

soolin said:

It is possible to link your paypal direct to ebay and do away with any need for passwords, it is called faster payments and recommended for frequent users to avoid keep logging in and can be used to pay for ebay purchases. The confusing thing here is that there is the issue that the address in paypal was left unchanged - yet parcel was diverted and that is an entirely different scenario which suggests this scam goes further than perhaps the OP has intimated.

As it stands there are possibly two scams going on here and that might be why the bank and paypal are reluctant to see the scam.

Oh, I didn't think about that. 

If the item was delivered to the wrong address, can eBay not issue a refund? 

In any case, I believe Natwest is the best chance at a refund. 

That's another angle entirely and definitely worth persuing. OP we need you to clarify what the paypal address was- NOT the ebay address but the delivery address shown against the purchase in paypal.

If the address for this purchase was not altered in paypal and RM will confirm the delivery address was wrong then an INR claim should be persued with paypal as another form or reimbursement. Once again a lot of persistence is likely to be needed.

BristolBoy33

Hello soolin and throwaway3000,


I referred the case to Action Fraud, then a few hours later rang the Police about it and they referred me to Action Fraud!!  I've also heard that AF are useless.

The delivery address currently showing Paypal is my home address.

I've just been messaging Paypal, as they've now said that the item was delivered to my home address, and it was signed for by [my surname] so "there was no 3rd party access during the period concerned".   They went on to say that if I wanted to make a claim for Item Not Received, I should let them know.   BUT I'm not sure about making an INR claim, because that suggests that I did actually buy it, I just didn't receive it - and I DIDN'T buy it!!

So I've gone back to them with all the details from the Royal Mail Tracker - the date it was sent, from where it was sent in Kent (presumably close to the seller's home address), all the stops at RM offices it made around London on the way, and finally the street and GPS coordinates that it was delivered to (in North London, 150 miles away from my home address).  I've described the recipient's signature as "three scratches" which are nothing at all like my own name or signature - so the "Signed for By" [my surname] on the tracking must be where eBay and Paypal got [my surname] from.  

I've made the point that if eBay's records show it was delivered to my home address - and this is demonstrably wrong - then there surely has to be doubt about all the other details recorded against this transaction, doesn't there?

But I'm still worried about this:

"The confusing thing here is that there is the issue that the address in paypal was left unchanged - yet parcel was diverted and that is an entirely different scenario which suggests this scam goes further than perhaps the OP has intimated.
As it stands there are possibly two scams going on here and that might be why the bank and paypal are reluctant to see the scam."     
I can't get my head round how the parcel was diverted.  The RM tracking shows that when it left the PO in Kent it went up to Gatwick, then to central London, then up to North London where it was delivered.  Surely it must have had the North London address on it (not my address) when it was dropped off at the PO in Kent?  So how come eBay and Paypal both show my address? Could it be the seller was in cahoots with the person in North London?  Maybe eBay and Paypal always had my correct address, but the seller manually put the North London address on the parcel before they despatched it?

soolin

Just to clarify an INR claim would work if PayPal will check and accept that item did not get delivered to the address given in Paypal, a seller cannot win unless delivery address matches.

The signature is immaterial, neither eBay or PayPal require a signature to prove delivery for goods (currently ) under £750.