iTunes hasn’t been hacked, though your PayPal might have been phished

Here’s a new scam to watch out for …

People who have seen thousands of dollars taken from their PayPal accounts apparently via the iTunes Store should look closer to home for evidence of hacking

Phishers have figured out a new way to transfer themselves loads of money and make it look legit: make it look like the charges are coming from the iTunes Store.

Problem is that they seem to have gotten greedy, which has made their greed surface. There’s a scattering of reports that iTunes accounts have been hacked – hello TechCrunch, with “Fraudsters Drain PayPal Accounts Through iTunes“, which says (a trifle breathlessly) that

“Reports are appearing this morning about a major security hole in iTunes accounts linked to PayPal. At least one group of scammers has found a way to charge thousands of dollars to iTunes accounts through PayPal. One targeted customer told us, ‘My account was charged over $4700. I called security at PayPal and was told a large number of iTunes store accounts were compromised.'”

Look more closely, though, and it doesn’t quite add up. Yes, people have seen their PayPal accounts drained of funds. Yes, they have received emails which say “Receipt for your payment to iTunes Store”.

But that’s where you have to look more closely. If you buy stuff on the iTunes Store via PayPal, the email subject line doesn’t read like that. As Mark Derrick notes, it will read “Receipt for your payment to iTunes”. Small difference, but significant.

Plus: the people who were scammed say that the receipt claims it was for the purchase (at $99.99 a time – clever one by the scammers, aiming to get it underneath the credit card “suspicion” level and also below the automatic level where the merchant has to bear the cost of reversing the payment) of “CastleCraft, Dragon Crystals (10000 Pack), Seller: Freeverse, Inc)”.

Except that while the US store (the only one which allows payment via PayPal) does have CastleCraft (iTunes link), which does come from Freeverse, there’s no product called “Dragon Crystals” and they don’t come in 10,000 packs.

So – a non-existent product and an email subject line that wasn’t generated by the iTunes Store. Conclusion: transaction not done via iTunes.

John Paczkowski at AllThingsD offers much the same conclusion:

“not much to their assertion that Apple is at fault here. There’s no security hole in iTunes, and if you’ve been unfortunate enough to have hundreds of dollars in unauthorized purchases charged to your iTunes account, it’s likely because you’ve fallen victim to a bot attack or phishing scam – a variation on the one that’s been around for years now. Sources close to Apple tell me iTunes has not been compromised and the company isn’t aware of any sudden increase in fraudulent transactions.”


The conclusion: iTunes hasn’t been cracked. PayPal has – or more precisely, some of its users have. This is almost certainly due to phishing where people have given up their passwords by being lured onto fake sites that have asked for their PayPal logins and passwords and got them. The crooks got greedy, which has meant that they got noticed; we can hope that PayPal, which goes to a lot of effort to track down organised scams like this, will put it all right.

Among those who fell victim was Dennis Rockstroh of the San Jose Mercury News; Apple told him that “Among other new security measures iTunes now requires more frequent re-entry of a customer’s credit card security code. But if your credit card or iTunes password is stolen and used on iTunes, we recommend that you contact your financial institution and inquire about canceling the card and issuing a charge-back for any unauthorized transactions. We also recommend that you change your iTunes account password immediately.” (What’s odd about Rockstroh’s account is that he says he contacted Apple, which reversed the transactions – however those were made against credit cards, not PayPal account

That goes of course for PayPal – though there’s no obvious mechanism by which scammers could use your iTunes account to make payments to themselves to PayPal. (Is there?) Even so, the rule remains: be absolutely sure before you enter critical data such as your username and password onto any site. © Guardian News & Media Limited 2010 | Use of this content is subject to our Terms & Conditions | More Feeds

Link to Original Content

Western Telematic, Inc. (WTI) designs and manufactures Serial Console Server products and Power Reboot Switch products that can simplify and streamline remote management of IT installations.

Tags: , , , ,

Comments are closed.