Security → PayPal User Charged $4,000 for Mac OS X Lion Download

By Leslie Horn

According to MacRumors, John Christman bought Lion on July 23 for $31.79, the price after tax. But then, for unexplained reasons, his PayPal account was charged another 121 times, adding up to a grand total of $3,878.40.
Christman certainly didn't mean to buy Lion for himself and 121 of his friends. He said Apple and PayPal blamed each other, and neither company would claim fault for the mistake.
"Apple blames PayPal, PayPal blames Apple," he told MacRumors. "They both are claiming to investigate but I am stuck broke for three days now. Apple claims there was only one transaction. When I told PayPal to dispute them, they closed the cases and marked the items as refunded on the 23rd. Bear in mind this money was taken and never returned yet."
So what caused the overcharge? Christman thinks it could be tied to an iCloud feature that lets iTunes automatically download past purchases. He told MacRumors he "fresh installed Lion" because his system needed to be upgraded before installation.
"I logged into our developer account and got the latest iTunes Beta, and installed it," he continued. "iTunes has a cool new feature to download all your purchased apps for you. I clicked download all. As each download started, it charged me $31.79. Some apps came fast, some took longer, but the timing was directly related to when a new app started to download."
In all, he downloaded 116 apps, though some downloads had to be restarted before they were complete. Meanwhile, the accidental charges have left Christman in the red, despite his PayPal account marking the purchases as "refunded."

»www.pcmag.com/article2/0 ··· 1,00.asp

Nice..even your savings are not secure when the Lion Roars.
--
Gladiator Security Forum
»www.gladiator-antivirus.com/

quote:

---

"They both are claiming to investigate but I am stuck broke for three days now. Apple claims there was only one transaction. When I told PayPal to dispute them, they closed the cases and marked the items as refunded on the 23rd. Bear in mind this money was taken and never returned yet."

---

HOW CAN THEY TAKE MONEY W/O YOUR AUTHORISATION??

Paypal sounds like more of a risk than a convienence!

I had kinda the same problem yesterday, but not to that monetary extent. My daughter used my PayPal account last night to purchase Angry Birds for her itouch for 99 cents through her iTunes account on her LT. It charged my PayPal account (which is funded through a CC) 7x. When I called PP to complain, my PP was credited with a refund only 5x a few hours later. When I checked my PP this morning, I was charged another 7x. Waiting for more refunds.
--
"Leave the gun, take the cannolis"

But note that the guy said he first downloaded a beta version of iTunes and then used a feature in that beta to get all his past purchases. That makes it sound like the problem may be with the beta version of iTunes. That would not be a big surprise, that a beta has glitches. Glitches don't usually lead to draining a bank account, however.
--
Don't let the pluperfect be the enemy of the perfect.

Why do people persist in using PayPal? It has a long history of corruption and total disregard for the user. How many class action lawsuits against PayPal have to be instigated to get folks to stop using them? PayPal has consistently ripped off both merchants and users. After what they did to a webmaster friend of mine years ago and to me, I would never touch them again...EVER. They should have been driven out of business years ago.
--
When governments fear people, there is liberty. When the people fear the government, there is tyranny. Thomas Jefferson

I have to agree with Mele here. PayPal is the absolute worst! Wouldn't touch them with a ten foot pole.
--
GuruGuy

I use PayPal only when there is no other option, and I fund it with the exact amount of my purchase.

Ya i suppose that way THEY CANT TAKE MORE than you authorise..

Merchants may automatically enter you into a billing agreement without asking or any notice, so you don't have to enter your Paypal password again to make another purchase and on mine they were set to use the bank account as a backup funding source.
--
Moe, I need your advice… See I've got this friend named Joey Joe-Joe... Junior... Shabadoo..

He should've disputed with the bank or credit card he has tied to Paypal.

I have a paypal account and only use virtual credit card numbers with it. Currently, they're all expired. Paypal would be unable to steal money.

From the MacRumors article:

quote:

---

Christman isn't the only person to face these issues surrounding Lion and PayPal. There is a lengthy discussion on Apple's support website about the issue, and other bloggers have run into similar problems.

---

Sounds like Apple's problem actually.

--
Think Outside the Fox.

I've been completely convinced for a long time that if things go south with Paypal, you're basically screwed, no human to talk to, no recourse, no nothing. Bad news.

But I still use Paypal , and this is entirely consistent with the above sentiment. I have actually avoided vendors that I preferred because they did not accept Paypal, in favor of inferior vendors that did.

Whatever we think about Paypal, the horror stories are more or less the exceptional cases, and though awful, are still exceptional.

What's far less exceptional is that some random pinkponies.com or suckymods.com or hotbabes.com is some guy (or gal) working in their garage, and pathologically unable to keep secure my credit card information. If I am dying to purchase a pink pony, how much time do I want to spend checking them out to make sure they're not idiots?

I don't doubt or discredit Mele20 's sentiment — I mean that — but I've done a lot more security audits than she has, and am far more jaded about the state of commercial security. It's far more common that I run into insecure idiots than I do people who have their act together.

In more than 10 years of doing pen testing, I've only been "caught" once by the network security staff. Everybody else has ignored the loud alarm bells and flashing lights of an intruder. If I can get the the credit card information, than so can the guy in the faraway land.

So in my mind, when I'm determined to purchase a pink pony, the lower risk transaction for me is to use Paypal.

Security is all about tradeoffs.

Steve
--
Stephen J. Friedl | Unix Wizard | Microsoft Security MVP | Orange County, California USA | my web site

I'm going to guess that you weren't being literal about that but just in case anyone might get the idea that that's a good option, it's a blend of science, instinct & finger crossing. LOL
(not a good way to handle a financial transaction)

Hmm, sorry, this was a user error.

I wonder if PayPal sent 116 email notifications for each transaction??

But if you had already purchased the apps that you were downloading, then why would you be charged again? That sounds like glitch in the iTunes store software.
--
Don't let the pluperfect be the enemy of the perfect.

Why? Because he didn't know how to use a "cool new feature" correctly and foolishly trusted the software?

That never should have made it through quality control. If anybody even has quality control these days.