2

I sent an email out to PayPal a few weeks ago, and no response to my question, so I've decided to bring it to the Community for help (as the issue has occurred just 30 minutes ago)

So, I'd say maybe a month or two ago (three max) I received probably 5 or 6 text messages regarding my PayPal 2FA code. It's from the same number that typically sends them, so I don't believe it it's a spoofed number, nor does it ask for any additional information. Just:

"PayPal: Your security code is: XXXXXX. Your code expires in 5 minutes. Please don't reply."

So, I don't think it's a spoofed number attempting to phish me. Anyways, I changed my password immediately and was good for a week or two. Then, I received more codes. Once again, 5 or 6. I changed my password yet again. Then a few weeks go by, more codes. I just changed my password yesterday or the day before as I had received more codes, and today I got more codes.

My question I guess is: How is this possible? How can I manage to receive 2FA codes days and weeks after changing my password. And please note: My passwords are randomly generated via Avast Passwords (A very reputable security company). They are 18 characters longed using a mixed character set of aZ 09 and symbols. They are beyond safe in terms of brute forcing.

I fail to see how my password can possibly be cracked? Another possibility I thought of was a key logger, or a potential virus. My password is generated within Avast Passwords, and stored on their servers, not on some file. And PayPal is the only issue I have this with, so if it was a virus, it should be happening on whatever sites I log into theoretically.

Is there a way to send 2FA codes to an account you're trying to log in to? Like, as a way to verify in case you forgot your password? Or is my PayPal password being cracked that fast? And if so, what security precautions do you recommend I take? Already ran multiple anti virus checks, and nothing has been found.

I'm dumbfounded on this issue.

Landon
  • 21
  • 1
  • Did you change your password using the same machine every time? If someone has infected your machine with some form of credential-grabber (keylogger, 'RAT', form-grabbing bot...) you can change your password as often as you want. If you do it on the infected machine the password will be gone again in seconds. – Ben Oct 17 '18 at 06:07
  • 1
    What's probably happening is that someone is (randomly) attempting "reset password" on PayPal using just your email address. When you do this, you get various options, including "send an email with a confirmation link", "answer security questions", or, "get a text with a code". So this is probably what's happening - it doesn't necessarily mean that anyone knows your password. – Jonas Czech Oct 17 '18 at 09:35

0 Answers0