Flaw in PayPal’s Google Pay integration leading to suspected fraud

PayPal users have reported signs of suspicious behaviour on their payment history that originate from their linked Google Pay account, with hackers thought to be exploiting an unknown flaw to commit fraud.

The payment service allows users to make contactless payments via Google Pay on a smartphone, through a virtual credit card which deducts money from their PayPal accounts.

According to a German security researcher, this mechanism is being exploited through an unknown flaw by hackers in order to make fraudulent transactions.

Streams of users are complaining about mysterious payments appearing on their PayPal payment history, according to German publication Golem, with deductions made ranging between as much as €500 and €1,000. There are also a series of one-cent withdrawals, with hackers likely testing the exploitation to see whether the method works.

The researcher suggested that due to the flaw, anybody near a PayPal user’s phone has access to the virtual credit card that deducts money from their account without authorisation.

He added that he disclosed the vulnerability to PayPal a year ago, and has followed with disclosure now due to the fact the company apparently hasn’t yet fixed it, despite paying out a fee through its bug bounty programme.

The company, however, told IT Pro that the issue has now been fixed.

Those affected appear to be based largely in Germany, although the fraudulent activity has allegedly been billed to US shops like Target and Starbucks. One user, for example, was charged €923.93 via the virtual credit card in Google Pay, which showed in their history as Target T-1401 in Brooklyn, New York.

"We never lose sight of the fact that we are entrusted to look after people’s money," a PayPal spokesperson told IT Pro.

"The security of customer accounts is a top priority for the company. We use advanced fraud and risk management tools to keep our customers and their payments safe.

"We quickly addressed and fixed this issue, which affected a very small number of PayPal customers using Google Pay in Germany. No personal or financial information was compromised, and no PayPal accounts were accessed by third parties."

PayPal’s security was previously thrown under the spotlight in 2018 when a teenage hacker revealed he could easily bypass PayPal’s two-step authentication procedure to access user accounts.

The Australian teen said he was able to bypass the multifactor authentication (MFA) process by spoofing a browser cookie created when users linked their eBay and PayPal accounts together.