floatplane Floatplane Exploit? Credit card fraud

[ThoSap]

Hi Linus Media Staff,

 

today the renewal of my Floatplane Club subscription for a whole year went through (26€).

Minutes later somebody made several purchases amounting to ~450€.

 

Fortunately my credit card institute noticed these purchases and blocked my card.

 

Is there a exploit in the floatplane purchasing process?
Please look into that!

Sincerely

ThoSap

 

[colonel_mortis]

You paid through the forum, so your payment details are held by PayPal. We don't have access to your card details at all. I'm afraid they probably got your details from somewhere else.

(We also don't get access to card details when you pay though the Floatplane site, but there they are held by Stripe instead).

[Ryujin2003]

You could have malware on your PC that was able to pick up the CC info. Ask your bank of this transaction was online or in person.

[ThoSap]

56 minutes ago, colonel_mortis said:

You paid through the forum, so your payment details are held by PayPal. We don't have access to your card details at all. I'm afraid they probably got your details from somewhere else.

(We also don't get access to card details when you pay though the Floatplane site, but there they are held by Stripe instead).

This CC is new (January 2018) and I never lost it.

Yes I paid with PayPal through the forum.

Seems reasonable.

 

This must have been online payments, nobody can buy things so fast in three different shops.

 

Now it's a good time to clean install Windows 1803

 

 

[Sauron]

@ThoSap be weary of keyloggers and phishing websites - always make sure the domain is correct and run an anti-malware scan.

 

Nice to see a fellow Italian  

[LogicalDrm]

If you can see these purchases on your PayPal account, then its you PayPal which has been hacked/breached. Always add extra verification if available for sites which handle payments or important passwords/email. PayPal supports both SMS and mobile (app) 2-factory Authentication.

 

Also, I would look more into that Nexi Pay thing. Its common across all of payments. Without knowing fully what that is and what it does, I would put fault on to it prior to anything else.

[ThoSap]

12 minutes ago, Sauron said:

@ThoSap be weary of keyloggers and phishing websites - always make sure the domain is correct and run an anti-malware scan.

 

Nice to see a fellow Italian  

Yes, I always do that. I'm a security freak

Greetings from Alto Adige (Südtirol)

 

4 minutes ago, LoGiCalDrm said:

If you can see these purchases on your PayPal account, then its you PayPal which has been hacked/breached. Always add extra verification if available for sites which handle payments or important passwords/email. PayPal supports both SMS and mobile (app) 2-factory Authentication.

 

Also, I would look more into that Nexi Pay thing. Its common across all of payments. Without knowing fully what that is and what it does, I would put fault on to it prior to anything else.

These payments have been made directly with the credit card credentials, not through PayPal, Skrill or any other payment service. I have enabled Two Factor Authentication on every payment website (where possible).

 

Nexi Pay is the official app of the Nexi credit card institute (former CartaSi).

 

Thank you all for your advices.

 

Sincerely

ThoSap