Hacker News Reader

Comment by Taek | Hacker News Reader

One of the biggest takeaways from this for me is that PayPal has awful security when it comes to compromised accounts. The only reason compromised accounts would trade for prices that high is because hackers have a high success rate of stealing funds from them, and a low chance of getting caught.

Credit cards and bank credentials being worth comparatively much less means that hackers don't have easy ways to secure the funds - either there's a high risk that the transaction is reverted, or there's a high risk that the hacker gets caught and goes to jail. You can tell it's not just an effort issue because the value of the accounts barely scale as the amounts in the accounts increase.

View on HN

It's hard to parse your take, I think the phrase 'security' must be overloaded.

Considering there are ~325 million active paypal accounts, wouldn't there be a huge supply if their security, overall, was lax?

And furthermore, isn't the security of a criminal getting money out of the system only equivalent to getting the money through banks?

"Paypal has awful security" -> it is easy and low risk to walk away with a bunch of cash if you get access to a Paypal account.

I'll try to re-word the GP, thanks for highlighting your confusion.

>wouldn't there be a huge supply if their security, overall, was lax?

i don't think normal demand curve applies to stolen bank accounts. the value of a stolen account would be the average amount of money you can expect to get out of it, regardless of how many stolen accounts are available. An increase in supply wouldn't make that any different.

For the raw account details alone it probably has more to do with being able to use it as a pathway to transfer ill gotten gains into/out of US/EUR than it does w/ the contents of the account. For the transfers from stolen accounts it looks like its just discounted based on probability that the transfer won't be reversed in time maybe?

I opened a new checking account just for Paypal that never has more than a $100 in it.

Do they? I mean, logging in is one thing, but transferring? I believe the hacked account owner can just get their funds back, and PayPal is very trigger happy at freezing accounts (especially new or idle) that get a large (a few hundred or more) sum at once.

So if you were to gain access to a stranger's account, you'd have to transfer the money to an existing, old and actively used account. Which is likely to be your own or your friend's.

Seems like a huge risk, so the hackers just sell the account to some idiot willing to try it.

Reply on news.ycombinator.com