PayPal is a digital payments platform whose account security, fraud controls, vulnerabilities, and breach disclosures can affect online transactions.
Search across headline titles and summaries.
Background for this topic.
PayPal is an online payment platform for consumer accounts, merchant checkout, money transfers, and payment-processing integrations. Its ecosystem includes web and mobile applications, APIs, account-funding methods, and merchant webhooks, so security news may concern PayPal services, connected applications, or the handling of payment and identity data.
The main security concerns are account takeover through phishing, credential reuse, or stolen session data; fraudulent payments and unauthorized transfers; and weaknesses in merchant integrations that mishandle API credentials or fail to verify webhook messages. Defenders should use available multifactor authentication, protect API secrets, validate transaction state server-side, and monitor unusual account and payment activity. Vulnerability advisories affecting PayPal software or integrated systems require prompt assessment, while suspected fraud or compromise calls for preserving transaction records, securing the account, and following PayPal’s reporting and recovery procedures. Privacy and payment-security obligations also depend on what personal and card data a merchant stores or transmits.
Weekly headline count for the current query.
PayPal is notifying customers of a data breach after a software error in a loan application exposed their sensitive personal information, including Social Security numbers, for nearly 6 months last year. [...]
An email scam is abusing abusing PayPal's "Subscriptions" billing feature to send legitimate PayPal emails that contain fake purchase notifications embedded in the Customer service URL field. [...]
An ongoing PayPal email scam exploits the platform's address settings to send fake purchase notifications, tricking users into granting remote access to scammers [...]
New York State has announced a $2,000,000 settlement with PayPal over charges it failed to comply with the state's cybersecurity regulations, leading to a 2022 data breach. [...]
Threat actors are abusing DocuSign's Envelopes API to create and mass-distribute fake invoices that appear genuine, impersonating well-known brands like Norton and PayPal. [...]
PayPal has filed a patent application for a novel method that can identify when "super-cookie" is stolen, which could improve the cookie-based authentication mechanism and limit account takeover attacks. [...]
Scammers are now exploiting the ongoing humanitarian crisis in Turkey and Syria: this time stealing donations by abusing legitimate platforms like PayPal and Twitter. [...]
PayPal is sending out notices of a data breach to thousands of users who had their accounts accessed by credential stuffing actors, resulting in the compromise of some personal data. [...]
The Indonesian Ministry of Communication and Information Technology, Kominfo, is now blocking access to internet service and content providers who had not registered on the country's new licensing platform by July 27th, 2022, as the country begins to restrict access to online content providers and services. [...]
A newly discovered phishing kit targeting PayPal users is trying to steal a large set of personal information from victims that includes government identification documents and photos. [...]
ProtonMail is urging its Russian user base to hurry up and renew their subscriptions before it is too late, as multiple payment processing services like Mastercard, Visa, and PayPal are exiting the Russian market. ProtonMail is a provider of privacy-centric and end-to-end encrypted email services to millions around the world. [...]