Call to regulate e-payment firms after fraudulent PayPal transactions
Customers, experts flag risk after recent fraudulent PayPal transactions
Published on Jun 03, 2013
PayPal does not offer two-factor authentication (2FA) in Singapore. A security expert said the firm should add the security layer to protect customers here. This includes requiring users to key in a one-time password generated by security tokens like the one on Standard Chartered Bank's dual-function card. -- ST FILE PHOTOS
By Irene Tham Technology Correspondent
SOME consumers and security experts are calling for e-payment service providers to be regulated like banks following a series of fraudulent PayPal transactions on users' credit cards recently.
This comes after The Straits Times reported over a week ago that hackers had stolen from a larger-than-usual number of Singapore PayPal accounts in the last two months, with losses ranging from $50 to more than $3,000.
Pharmaceutical executive Lim Mei Ee, 30, said the relevant authorities should "put pressure" on PayPal to add more security layers before letting a credit card purchase go through.
This includes requiring users to enter a one-time password (OTP) - randomly generated on security tokens or sent via text messages to users' mobile phones.
BACKGROUND STORY
How fraud could have occurred
MS MYLA Pilao, director of core technology at security software firm Trend Micro, said PayPal is one of the top two commonly "phished" sites, the other being eBay.
Phishing is a method used by fraudsters to trick their targets into revealing credit card information, passwords and other personal details.
When unsuspecting users click on an embedded link in a phishing e-mail or instant message, they will be led to a bogus website where they will be asked to enter their personal information and passwords.
Another way cybercriminals steal users' passwords and credentials is through malware that has infected computers. The malware captures users' keystrokes surreptitiously.
PayPal's website could also have been hijacked by hackers, but the company maintained that its system was not hacked into.
IRENE THAM
