Consumer complaint received 2021-03-30
Product: Money transfer, virtual currency, or money service — Domestic (US) money transfer
Issue: Fraud or scam — 
Company: Paypal Holdings, Inc (GA)

This complaint is about PayPal. On XX/XX/XXXX, several fraudulent activities occurred in my PayPal account. These activities involved : ( 1 ) the fraudulent sale of my XXXX  and XXXX  in my PayPal account ; ( 2 ) the introduction of a XXXX Visa Debit card to my account, which was used to transfer funds out of my account ; ( 3 ) the following purchase of bitcoin with this XXXX Visa Debit card, with the funds that had been fraudulently transferred out of my account ; ( 4 ) and finally the removal of the XXXX Visa Debit card only 30 minutes after it had been added to my account! 
I have used PayPal for some time for merchant purchases, to limit exposure to my credit card information.. 
Recently PayPal began marketing XXXX and XXXX, so I made purchases on XX/XX/XXXX, XX/XX/XXXX and XX/XX/XXXX. Prior to these purchases, I held NO asset balance with PayPal. 
Only 14 days later from my last purchase, the above fraudulent activities occurred on XX/XX/XXXX. 
I have attached support material regarding my multiple claims. 
In addition to the previous fraudulent activities, the perpetrators of the fraud made three fake address changes, involving three different states. 
It appears that the fraudsters KNEW that cryptocurrencies were in my account, as demonstrated by their final purchase of the XXXX and the timing of the fraud. They also knew that the Two Stage Authentication, which PayPal claimed was in force on my account since XX/XX/XXXX was, in fact, NOT ACTIVATED, and as a result was vulnerable. 
If the Two Stage Authentication was active, my account could not even be logged into without receiving an activation code via my cell phone. The evening of the fraud, when I called PayPal using my cell phone to report the fraud and reset my login password, was the FIRST TIME that an authentication texted code was required to access my account. PayPal claims that a texted code was initially sent to my smartphone and used by me to allow the fraud to take place, but that is NOT THE CASE! I sent PayPal a picture of my cellphone text messages from the XX/XX/XXXX time frame, and it shows that NO CODE WAS SENT ( see attached )! A texted code was NEVER REQUIRED to access my account, prior to the night of the fraud, when I reported it and requested a password reset. I then requested the account be locked down. 
My many appeals to PayPal have resulted in the same form letter response. 
On the night of the fraud I responded to PayPal 's emails, that the address changes were bogus, but on XX/XX/XXXX when I called XXXX to renew an appeal, the bogus addresses were STILL SHOWN ON MY ACCOUNT. I called XXXX where the XXXX Visa Debit card was issued, and was told that no record of my name or social security number was registered at their bank, and the actual owner of the XXXX card would not be divulged, and to report the incident to the government fraud site. PayPal made no attempt to track this card 's owner, but just blamed me. 
PayPal did not send me authentication codes prior to the fraud. They merely sent notifications of changes to my account via email, requesting me to notify PayPal immediately if I did not initiate the changes myself. I did not see the emails regarding the fraudulent changes until the evening of XX/XX/XXXX, AFTER THE FRAUD HAD TAKEN PLACE. I did not authorize the fraudulent changes using the two stage authentication code as PayPal claims, because it had not been activated on my account.

PayPal was negligent in safeguarding my account and accepts no responsibility in their lack of oversight. If two stage authentication was active, these fraudulent activities could not have taken place. 
Supporting documentation is attached.