Hello, welcome to the Wednesday, February 26, 2020 edition of the Science and its Storm Center's Stormcast. My name is Johannes Ulrich, and today I'm recording from San Francisco, California.

Yesterday, German tech website Heiser reported that some odd fraudulent PayPal charges are hitting users in Germany. While PayPal

initially didn't comment a security researcher, Marcus Fenske reported to Heise that he reported a security

issue to PayPal that he actually received a bug bounty form, PayPal said they had

fixed, but he believes isn't completely fixed and that's related to virtual credit cards.

Now if you get a credit card from PayPal, PayPal works with MasterCard on that, then you can assign the virtual credit card number to your

Google Pay account.

And this number is supposed to be only useful with Google Pay.

So if it gets compromised, well, the thief cannot use it for anything because it's sort

of linked to your Google Pay account, and it should really be useless.

Now, one issue with these credit card numbers is that, first of all, they apparently can be used with other payment methods.

For example, with Amazon pay and such, and also the CVV number, the three digits on the

bag, are never actually verified with these virtual credit card numbers. So that makes it a little bit

easier to guess them, in particular since the first eight, so the first half of the six digits are fixed for these credit card numbers.

Now the first four to six numbers, they're usually referred to as the bin or the bank identification numbers,

and they would be linked to PayPal here in this case, but with these virtual credit card numbers, well, PayPal then

fixed a couple additional numbers, so the first eight numbers are always the same.

Also, there is a chance that these virtual credit card numbers leak via NFC from your Android devices if you're using them as part of Android of Google Pay.

So that way they could also potentially be leaking.

Hard to tell what exactly happened here.

PayPal eventually responded to Hisei saying that none of their systems here were compromised,

but just brute forcing credit card numbers or that leaking via NFC, of course, that wouldn't

...