21 October 2017

44975

Retired Member

3,171Posts 11,354,340Views 3,408Comments
Information Security

Information Security

The risks from Cyber cime - Hacking - Loss of Data Privacy - Identity Theft and other topical threats - can be greatly reduced by implementation of robust IT Security controls ...

False Accusation leads PAYPAL to disclose Accounts of others

07 February 2010  |  5577 views  |  0

If you find your name in this list, it means that you are one of the many collateral victims of a psychopath who was able to manipulate the french authorities (in the south of france) to requisition information from EBAY and Paypal by making a false accusation against someone.

One of the collateral victims is the wife of Senator John Kerry.

One collateral victim already acknowledged getting harassed and getting severely affected by this. 

This requisition which was based on a false accusation resulted into Paypal disclosing several individuals accounts and other private information (IP address, physical address, email accounts, phone numbers, transactions).

The falsely accused (main) victim does not know these individuals that were dragged into this investigation.

List of collateral victims whose accounts were disclosed by Paypal can be seen here.  Only the first initial and the last name are shown plus city and state of residence.

Was this an error or was this an abuse of authority? Was this a one-time incident or can this happen again? Whatever it was, it certainly is a real story of how our privacy can be so easily violated.

TagsSecurityPayments

Comments: (6)

A Finextra member
A Finextra member | 08 February, 2010, 10:41

I don't know anything about this but I do note paypal seems to be having some issues in India. The comments from users are here. The clue appears to be 'personal payments', an area where money laundering and other concerns emerge.

Reports suggest that some Indian payments (possibly for 'services') are being credited back to the 'purchasers' and the funds either blocked or retrieved from the 'sellers' bank accounts which may leave some with negative bank balances. The perils of global payments.

Be the first to give this comment the thumbs up 0 thumb ups! (Log in to thumb up)
A Finextra member
A Finextra member | 08 February, 2010, 12:00

 

Thanks Dean for that link to paypal indian issues. Not sure that it's related to my original blog.

Among the many issues that my original blog raises is the responsibility of PAYPAL or a payment institution in disclosing information about its clients and in this particular case, disclosing information not only based on a false accusation but also disclosing information of other people that are completely unknown to the psychopath who filed the false accusation and are also unknown to the main victim. 

Who is at fault in violating the privacy of the individuals? Is the payment institution's legal counsel responsible for evaluating each request and challenging the legality of the requisition? In this specific case, the requisition was as a result of a false accusation of a man against his own wife. In France, as like probably in many other countries, there is no 'theft' between husband and wife, specially while they are married and living together and the regime of their marriage is community property. The man accused the wife of opening up a paypal account under his name while they were married and living together, when in fact the bank account linked to this paypal account was a joint bank account, with both their names (Mr. X or Mrs. X). Paypal at the time of the creation of the account allowed only one name (paypal joint accounts could not be registered).

Any lawyer in France knows that there is no 'theft' between husband and wife, ergo, paypal should not have complied with the requisition based on the husband's false accusation.

Another question is how did these innocent other people get involved? Isn't it paypal's responsibility to evaluate the broadness or the specificity of the requisition?

Obviously, the 'gendarmes' and the judge who signed the requisition in the south of france were most likely manipulated (by the husband) into thinking that they are pursuing a big fish, but they should also uphold the laws that apply and know beforehand not to accept the husband's complaint.

This is a specific example. But what comes to mind also is a scenario wherein someone is accused of money laundering, or being a terrorist that uses paypal, or being a marijuana grower that buys seeds from Holland or being a pedophile that buys things in the internet for example.

Combine all these scenarios with identity theft and one can just imagine what kind of problems could result in a payment institution's complying with such requisitions.    

 

Be the first to give this comment the thumbs up 0 thumb ups! (Log in to thumb up)
A Finextra member
A Finextra member | 11 February, 2010, 09:32

Marite, this blog does not link to a news article; the "original article" tag line is not hypertext, and searching Google with it, I could not find anything pertinent.  Without at least an internet news story, how can we know whether this even happened?

On a related note, I am very puzzled by your use of a link on the word "psychopath".  If we had a clue who the person was you were applying it to, it would be libelous without a lot of documentation (maybe even then) so I expected this link to go to where someone else had already determined the unnamed person is psychopathic. Instead it just links to a Wikipedia definition of "psychopath".  That sort of thing is usually used for technical jargon that the reader cannot be expected to know.  But most of your readers have a pretty good idea what you mean by psychopath.  What is going on here?  Also the "list" link is just a Google Doc and since I cannot access it, I don't know whose it is and whether it's public or private and whether it's reliable as a source or not. All in all, this is a very confusing blog post.

Be the first to give this comment the thumbs up 0 thumb ups! (Log in to thumb up)
A Finextra member
A Finextra member | 11 February, 2010, 10:03

Hello Debra,

I have all the documents, the requisition, the gendarme's statements, the false accusation. Most importantly, I am the main victim of this false accusation. My boldness lies on the fact that I have proven and can prove that the accusations were false.

I can't say any more or less but this false accusation has had effects on me that are beyond inhuman

I don't why you cannot access the list. I checked the file sharing attributes and its shared to everyone.

Marite

 

Be the first to give this comment the thumbs up 0 thumb ups! (Log in to thumb up)
A Finextra member
A Finextra member | 11 February, 2010, 10:09

I also want to add that if this did not happen to me, paypal users (like myself) would never know that their privacy can be violated.

Be the first to give this comment the thumbs up 0 thumb ups! (Log in to thumb up)
A Finextra member
A Finextra member | 11 February, 2010, 10:10

Oh, I see.  You never said in the post that you were personally involved.  That's a different matter.

I suspect it's my company's firewall that is not allowing me to see the list documents.  I will try at home and can probably see it there.

Thanks for enlightening me; I am not confused anymore :)

 

 

Be the first to give this comment the thumbs up 0 thumb ups! (Log in to thumb up)
Comment on this story (membership required)

Retired's profile

job title
location
member since 2014
Summary profile See full profile »

Retired's expertise

Member since 2009
3119 posts3,408 comments
What Retired reads

Who's commenting on Retired's posts

Ketharaman Swaminathan
Dharmesh Mistry
Nicola Cowburn
Michael Wright
Charmaine Oak
Francis Chlarie
Raymond Lee
Deepthi Rajan
Melvin Haskins
João Bohner
Bob Lyddon