Consumer complaint received 2016-10-14
Company: Paypal Holdings, Inc
State: NJ
Product: Prepaid card
Sub-product: Gift or merchant card
Issue: Unauthorized transactions/trans. issues

Complaint:
I have been a PayPal customer since XX/XX/XXXX with no incidents in that time. The PayPal XXXX XXXX subsidiary of PayPal Holdings has had a major security flaw that became public in XX/XX/XXXX. Specifically, PayPal 's system had a security flaw that allowed the redemption pages of electronic gift cards purchased from PayPal XXXX XXXX to be indexed by search engines like XXXX and permanently cached by XXXX. As a result, any third party knowing how to run the proper search on XXXX could access both gift card numbers and pins and drain the gift cards of all value. 

I purchased XXXX XXXX XXXX gift cards from PayPal XXXX XXXX XX/XX/XXXX. As soon as I learned of the security issue in XX/XX/XXXX, I checked the balances on the cards and learned that XXXX of my XXXX XXXX XXXX gift cards had been completely drained of all value by an unknown and unauthorized third party. Neither of these gift cards had been used by me, and I protected all information including the gift card numbers and pins. I note that I purchased XXXX XXXX XXXX gift cards in total, and XXXX of the cards were properly used by me, while the other XXXX were drained by an unknown third party. 

In total, I lost {$300.00} ( {$150.00} for each of the XXXX gift cards ). In communications that I have documentation of, PayPal has created multiple barriers to getting timely resolution of the case and the refund of the lost {$300.00}. 

Most of their customer service representatives have not been informed of and trained on how to address the issue, and give deflecting responses ( for example, encouraging customers to seek resolution with XXXX XXXX even though the security flaw was on PayPal 's side ). 

I finally reached a representative that seemed to have knowledge of the situation, and I have an open case number with PayPal, but we are now long past when I was told to expect resolution and a refund. 

There is extensive documentation of this problem on the Internet, for example at : XXXX XXXX XXXX This seems to be a major problem that could impact XXXX customers, and PayPal has not taken proper proactive steps to inform customers of the problem and that their gift cards may be at risk. 

In addition, PayPal has not provided me with timely resolution of my open case. They have created so many barriers to resolution that many customers are reporting on the Internet that they are giving up hope of gaining resolution. It appears that PayPal has realized that they have a large potential liability due to their security flaw, and they hope that by putting enough barriers to resolution in place, they will discourage customers from making it through all of the barriers. 

In recent responses to some customers published on the XXXX, PayPal is claiming the security flaw only lasted from XXXX XXXX to XXXX XXXX, but many customers are reporting on the Internet that gift cards dating back to XX/XX/XXXX were accessed in an unauthorized fashion. It seems like PayPal is either engaged in covering up their liability, or still do not fully understand the full extent of their security flaw. 

There is no way any third party could have had access to my gift card numbers and pins through me. Given that my gift cards were drained XX/XX/XXXX, concurrent with when the security flaw became public and concurrent with when other customers are reporting similar problems, it seems clear that my cards were part of PayPal 's security flaw.

Company response to consumer: Closed with monetary relief