Cdkeys purchase how did scammer use my Paypal account?

pjmony

My wife received an email from Cdkeys saying she'd bought an Xbox 'code' for £6.99
Then an email from Paypal about the purchase.

She does not have a Cdkeys account and had made no such purchase.

How was someone able to buy this using her Paypal account?
I thought you'd need an authentication code or similar to complete it.
She has to enter a 6-digit code sent via SMS to login.

Since she rarely used it we've closed the Paypal account to avoid it happening again.

Paypal and Gmail accounts don't appear to have been hacked.
So I'm puzzled how this happened and how to stop it happening to others.

Cheers

Olinda99

silly question but are you sure it wasn't just a scam email - did 6.99 actually come out of your paypal account ?

pjmony

Sorry, I should have said.
It was a genuine email.
We logged in, saw the transaction.

As it happened it had some credit we'd forgotten about. So transferred that out and closed the account.

A quick google suggested we were unlikely to get the money back from either Paypal of Cdkeys.

Mark_d

So the Paypal account wasn't hacked.

If her phone is still working then the number can't have been ported away.  Did her phone receive the SMS code?  I tend to have to go to the Junk folder on my phone to receive 2FA codes.
Could someone else in the house have access to your wife's passwords and phone?

Spending £6.99 on an Xbox code would give the criminal a high chance of being stopped (unusual retailer) and would net the criminal very little value.  Perhaps your wife spent the money whilst not thinking clearly...or possibly the offender is a child.

pjmony

Her phone seems fine. She was still getting the codes to let her login to Paypal.
She's not a 'gamer' so has never used Cdkeys (I have but never use her phone etc..)
No kids here to 'borrow' the phone.

I wonder if the fact she never had a Cdkeys account may be a factor.

When I've used Cdkeys / Paypal I thought I had to use the Authenticator app to login to Paypal to 
finish the payment.

I'm at a loss to explain how the scammer managed to pay without access to her phone, iPad or gmail.

I'll check if she received any other unusual emails/SMS

Given her purchase history I suspect Paypal don't do spending checks

GrubbyGirl_2

pjmony said:

Her phone seems fine. She was still getting the codes to let her login to Paypal.
She's not a 'gamer' so has never used Cdkeys (I have but never use her phone etc..)
No kids here to 'borrow' the phone.

I wonder if the fact she never had a Cdkeys account may be a factor.

When I've used Cdkeys / Paypal I thought I had to use the Authenticator app to login to Paypal to 
finish the payment.

I'm at a loss to explain how the scammer managed to pay without access to her phone, iPad or gmail.

I'll check if she received any other unusual emails/SMS

Given her purchase history I suspect Paypal don't do spending checks

She needs to change her email password as a precaution as you can choose to receive an email for 2FA