2016 Reality: Lazy Authentication Still the Norm
Summary: Brian Krebs reports that his PayPal account was taken over on Christmas Eve by an attacker who called PayPal support, claimed to be him, and reset his password using only the last four digits of his Social Security number and the last four digits of an old credit card. After Krebs reset the account himself, the same rogue email address was added back within 20 minutes, and PayPal later told him it had no mobile authentication technology, requiring a scanned driver's license to restore access.
Bottom line: The takeover succeeded because static identifiers - SSN and card digits Krebs says have been posted online by miscreants - were enough to reset a password, and PayPal's monitoring failed to flag the same fraudulent email address added twice. Krebs notes that any company authenticating customers with static identifiers, including banks and utilities, is exposed to the same attack.
Read the original at Krebs on Security ↗
- Topics
- Identity & Access Management
- Related
- FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026Sponsored: Specter Ops on the impact of AI agents on Blood Hound Cyber Risks · Sep 20, 2026