Tutorial: PayPal Man-In-The-Middle attack

livethebeat

Professional
Messages
185
Reputation
22
Reaction score
31
Points
28
A lot of you may be familiar with this as it's one of the oldest but most successful tricks in the book but considering this is the beginners section I thought I'd help out those new to the game.


1. What is Paypal?

- PayPal is an e-commerce business allowing payments and money transfers to be made through the Internet. PayPal serves as an electronic alternative to traditional paper methods such as checks and money orders and has been involved in many ligations concerning fraud scams.

A PayPal account can be funded with an electronic debit from a bank account or by a credit card. The recipient of a PayPal transfer can either request a check from PayPal, establish their own PayPal deposit account or request a transfer to their bank account. PayPal is an example of a payment intermediary service that facilitates worldwide e-commerce.

PayPal performs payment processing for online vendors, auction sites, and other commercial users, for which it charges a fee. It sometimes also charges a transaction fee for receiving money (a percentage of the amount sent plus an additional fixed amount). The fees charged depend on the currency used, the payment option used, the country of the sender, the country of the recipient, the amount sent and the recipient's account type.



2. "Man-in-the-Middle" Scam

- The scam involves a little bit of social engineering and timing. Basically this scam is broken down into three areas:

a.Seller:
- The seller will be the victim in this scam. The seller is the party selling the item/goods/product you wish you obtain.

b.Buyer:
-The buyer is the party you will be 'borrowing' the money from.

c.Attacker::
- The attacker is you, you sexy beast.

How the scam works

The scam is actually very simple but despite how simple it is, it still has a 95% success rate.

Basically the attacker (you) borrows the money from the buyer to purchase goods from the seller.

Sounds pretty simple, eh? It is.

This is how it's done.

You find an online ad/website where the seller accepts PayPal as a payment option. Let's say the seller is selling a MacBook Pro for $1,500 you contact the seller and talk to them, ask questions about the laptop etc. basically trying to stall them for time.

While you're doing this, you post an ad on craigslist/kijiji/other classifieds website or eBay for that exact same laptop for the same price.

If you're using a classifieds ad to get a buyer then you'll have to talk to the buyer, answer any questions the buyer has but since it's a classified ad they'll be skeptical about trusting you. Sometimes they'll request that you take a picture of the laptop with a piece of paper saying something, usually their email address or user name. No problem!

What you do in this situation is the exact same thing the buyer is requesting from you. You contact the seller of the original laptop and ask them to take a picture of the laptop with a piece of paper with whatever the buyer is requesting from you.

If you don't believe this works, here's an example of social engineering in practice:

photodi.jpg


Once you get the sign picture, you send that picture to the buyer to gain his trust that you actually have this laptop.

Once the buyer agrees to buy the laptop from you and requests for your PayPal email what you do is you tell the seller you were just talking to that you want to buy his laptop and need his PayPal email address to send the payment to.

Once you have both emails from the buyer and seller you tell the buyer to send the payment to the sellers email address. Once the buyer sends the payment give the seller YOUR shipping address. It's up to you to convince them why not to ship to your verified PayPal address but it's generally simple.

Give them your drops address (You don't want to use your real address unless you're sure you won't get caught).

The seller receives your buyers payment while the seller ships the laptop to your address.

Couple of weeks later the buyer retracts his payment and the seller is out of a laptop. He'll email you angrily with his fists in the air.

You can do this with pretty much any item. The best things to scam are things that don't need shipping, obviously; like World of Warcraft accounts ($300-$1200), Game Time Cards, CD keys, Windows Vista/7 CD-Keys etc. But if you have drops then laptops and electronics like iPhones etc are good to scam and bigger money.

If you have any questions post them in the thread and I'll answer them.


(c) livethebeat specifically for carder.market
 

xoxoxo

BANNED
Messages
16
Reputation
0
Reaction score
0
Points
1
Please note, if you want to make a deal with this user, that it is blocked.
damn u are awesome bro i can do this easy i already have experience on the type stuff i used to do 419. thanks bro.
 

pacm@n

Professional
Messages
152
Reputation
16
Reaction score
16
Points
18
good guide, you make it sound simple ;)
 

livethebeat

Professional
Messages
185
Reputation
22
Reaction score
31
Points
28
What do you mean Just4Fun?

Yes it can work with eBay. When you win the item tell the seller that you are having problems paying with your PayPal and it's giving you a headache. Get the 'buyer' of your fake laptop to send the payment to the sellers PayPal. Then message the seller back and tell them you sent the payment but you're having troubles editing your shipping address in your paypal account so tell them your shipping address in the message.

If all goes well the seller will ship the laptop to your shipping address instead of the one on the buyers PayPal account.

It's best to do this from a seller with lower feedback on eBay generally you want under 100 feedback since they are likely to be less experienced with eBay and PayPal.

---------- Сообщение добавлено в 08:05 PM ---------- Предыдущее сообщение размещено в 07:59 PM ----------

Oh sorry yes this works with virtual eBay items except you realize that you don't need to use the man in the middle technique to buy virtual items right?

To be honest, you can go to MoneyMart/CashMoney/NetSpend and get a prepaid visa/mastercard even with your OWN name on it. Make sure you have at least $5 on it. Then make a new paypal and add your prepaid credit card to it so you get a nice verified paypal.

Then just post a fake laptop/xbox360/ps3 or something for a cheap price and when the buyer sends the money to you after winning your item you can INSTANTLY go and buy virtual items on eBay.

They usually ship the CD-Keys/TimeCards whatever it is you're buying that's virtual they send it to you instantly or within 24 hours.

Once you have the virtual item it's too late. You can remove the prepaid credit card from your PayPal (if you want, you don't have to) and abandon the PayPal account.

Nothing will happen to you.

When I was younger (I'm talking high school young) I use to do this because I didn't know any better about anonymizing yourself but I never once got caught, a letter or a phone call about anything. It's PayPals loss and it ALWAYS works. You can spend the money as soon as you get it.
 

L4456

Carder
Messages
34
Reputation
0
Reaction score
0
Points
6
livethebeat, it's trully a noobish scam i once thought to do this with ebay
who knows, maybe it works:D
thx anyway for post
 

livethebeat

Professional
Messages
185
Reputation
22
Reaction score
31
Points
28
livethebeat, it's trully a noobish scam i once thought to do this with ebay
who knows, maybe it works:D
thx anyway for post

Definitely an old scam but believe me when I say it still works ;)
 

coolwas

RIPPER
Messages
18
Reputation
0
Reaction score
0
Points
1
but every time ibuy from ebay icheck out as a guest and when the paypal page comes out i say no im not member kk and i filout the form with cc infos but after my cc wont work imean like before it was working perfect but now every cc that i try they diclined it
is it because of my ip?
 
Top