How someone hacked and stole money from my Paypal

This happened last month March 2025. This was a newer Paypal account that I had made. They first sent me $.01 I’m assuming to test to see if I had a Paypal account associated with that email/phone number. I’m 99% positive that they sent it to the phone number on file and not my email because the email I used was one of those ‘hide my email icloud emails that is like stents.hankies.08@icloud.com’ that I’ve only used it at one other place. Anyway, a minute after I got an email that I was sent a penny, I got a Paypal email saying my password was changed. Then 2 minutes later, they sent themselves $44 using the debit card on file. Then oddly 10 minutes later, they sent themselves $42 to that same person. Then about 9 minutes after that, they sent $49 to a different person. Then about 30 minutes later, I got an email from Paypal saying I was not eligible for Paypal savings because they couldn’t confirm my identity. And that was that. All of this happened at night and so I didn’t figure it out until the next morning.

Now you’re thinking, “Oh this should be easy to fix…” Well first of all, I can’t log into the account because a) I had used a temporary phone number when I had created the account and no longer have access to that phone number so even though I can do ‘forget password’ and log in with the emailed code, fucking Paypal wants a 2nd authentication method – either the phone number or ID. Now you’re thinking, “Well just upload the ID…” Yes that would be great if I haven’t been banned dozens of times from Paypal so I don’t even want MORE EYES on the account. I mean, at this point, I may still upload the ID just to see what Paypal would do, I guess I could even call in but I hate making calls.

The question is – how did they even get into the account? I don’t think they got in via email since they shouldn’t have known that email address. My guess is they logged in with the phone number using my password – but that’s nearly impossible since the email and phone number won’t have a matching password on the dark web. I’m guessing they got in by using the ‘forget password, text me a code.’ The odd thing is that I’m surprised Paypal didn’t make them authenticate with a 2nd method like they are doing with me now.

Now I tried to contact my bank to see what I can do about disputing the charges and shockingly, they never got back to me. This is one of those fintech debit cards IYKYK.

The biggest lesson learned for me is that I should FREEZE all my virtual debit cards until I’m ready to use them. These fintech debit cards won’t help you since debit cards don’t have the same kind of protection that a credit card would have. I’m just glad they didn’t try to really go hard and liquidate my bank account; $135 is sort of a cheap lesson learned here.