Posts Tagged ‘hackers’

Why I Don't Trust PayPal or iTunes (Anymore)

datePosted on 07:36, March 16th, 2009 by Andrew

On March 5th, I received four rather alarming e-mails. They were receipts from the iTunes store from earlier that day at a point in time during which I was in bed and asleep. These purchases totaled $500 worth of gift cards, which upon viewing in the iTunes Store history all seemed to have a message along the lines of, “Andrew, for me, Andrew.”

hacked itunes purchase

By now, I’m freaking out, because I don’t even have $500 in my bank account at this point in time. I immediately go to PayPal and file a report to them that I’ve had four unapproved charges to my account that I would like to dispute, as well as change my passwords and security questions on both iTunes and PayPal. Next, I run virus scans and clear browser history on every computer I own, plus my iPhone to check for spyware and such (resulting in no spyware per say, but some apparently interesting cookies). Because the charges were made early enough in the day and were marked for immediate withdrawal on PayPal, I assumed that when my bank account still hadn’t taken a hit that PayPal was starting to do something about it, so foolishly I didn’t call my bank and tell them what’s going on yet.

On March 6th, I check my bank account balance. -$260. Ohhh craaap. First things first, I transfer enough money from my savings to cover the negative balance in my checking (I now have some change in my checking, and a few bucks in my savings). I shoot an e-mail to iTunes telling them what’s up and ask what I should do and how they can help me, and then I call my bank’s fraud department, who tells me I should wait until after PayPal investigates the case, and if PayPal doesn’t refund my money, I should call them back (something about lots of paperwork being involved and it being easier to see if PayPal fixes it first).

On March 7th, I get an e-mail back from iTunes. What follows is the relevant information, plus they said the obvious: change your account password and security questions.

I urge you to contact your financial institution as soon as possible to inquire about canceling the card or account and removing the unauthorized transactions. You should also ask them to launch an investigation into the security of your account. Your bank or credit card company’s fraud department should then contact the iTunes Store to resolve this issue. The iTunes Store cannot reverse the charges.

Right. This e-mail, plus a blog post by Chris Pirillo that I read while searching for information about my situation on Google made me think that filing claims with PayPal was pretty much NOT the way to go if you ever wanted a chance of getting your money back, though at the request of my bank, I waited to hear back from PayPal before calling them again.

On March 12th at 4:42 am, I received an e-mail from PayPal which said the following:

We have completed our investigation of your claim and have determined that
this is not an instance of unauthorized account activity. At this time,
your claim has been denied.

Okay, freeze. Let’s think logically for a second and look at what PayPal and iTunes are claiming I did.

  • They assume I purchased FIVE HUNDRED DOLLARS worth of gift cards in FOUR SEPARATE TRANSACTIONS. The $500 worth of gift cards doesn’t really seem like something someone would do, but for the sake of the argument, lets assume people do that all the time, and do it in four separate transactions to be sent to (what I’m assuming) was the same e-mail address.

    Factoid: When looking at your purchase history, you can’t see the e-mail address that the gift card redemption link was delivered too.
  • The content of the “to, from, and message” fields on the gift card’s picture imply that not only did I purchase $500 worth of gift cards on iTunes, but I sent them to MYSELF.

    Factoid: as this Washington Post article states in an update, since the beginning of March 2009, “the [Internet Crime Complaint Center] has received a total of nine complaints about credit card fraud related to unauthorized purchases on iTunes” for charges as much as $1,600.
  • Finally, PayPal and iTunes assume that I reported my own transactions as fraudulent no less than 5 hours after I made the purchases, including many e-mails and even a couple phone calls to PayPal to make sure the fraudulent charge claims went through.

    Factoid: The Watchmen is a fantastic movie, and I think it’s a shame if you haven’t seen it (I ran out of related facts).

So here we are. It’s March 12th, and I have just woken up to some bad news, which only gets worse when I look at my bank account, and despite the fact that I put money in the account the same day it dropped into the red via an IMMEDIATE online transfer, I have overdraft fees (putting it firmly BACK in the red). My parents, worried about me and my utter lack of money, write my a check for $400, which I take to the bank and ask to talk to someone about what I can do.

The people at my bank are very nice. I showed up about the same time they were going to have the lobby closed, and despite the long line to talk to a customer service representative, they let me in and even offered me candy and coffee. When my turn came to talk to someone, I explained to them my situation, and they gave me a phone number to call. They also told me that despite my negative account balance, the fact that I needed money to buy food and pay utilities meant that I would be much better off going to my parent’s bank and cashing the check (the check funds would have been put on hold for what she said could be up to two weeks).

Now here I am. It’s 7am on March 16th, I’ve got a bit of cash on hand, and my bank’s fraud department has what they called, “a large stack of papers” in the mail for me to fill out, sign, and return in order to take some sort of legal action (I think) to get back my money.

If I learned anything from this ordeal, it’s this:

  • If at ALL possible, avoid using PayPal. They have horrendous customer service, and will do anything to place the blame on someone else.
  • If you’re going to make online purchases (something I do A LOT), credit card gift cards from grocery stores are the safest way to go, and some banks even offer features like a separate account thingy for online transactions that you can set up with purchase limits, time frames, and even a disposable account number.
  • Don’t make online purchases just to skip out on sales tax. That sales tax going to your local government helps pay for roads, parks, and lots of other things that communities need to thrive.
  • Finally, if there’s a local music store nearby, don’t be too lazy to go there to get your music. The best thing you can do for the economy in times like these is buy local and support small businesses.

Thank you all for your moral (and financial) support while I try to get through this mess. I couldn’t do it without you guys.


**EDIT**

After filling out the large stack of papers from my bank and faxing them in, the money was returned to my account and I soon got a letter from them telling me what they had repaid me. I also tried to update applications on my iPhone, which gave the message that my account had been disabled, but a quick email to iTunes customer support explaining what had happened got me access to my account again within 24 hours.