Paypal and Skype hacked.

[#1]

Hi. I have signed up for the forum to get some help.
On 9th Jan 15 I noticed a paypal email receipt email in my inbox. When I opened it I saw it was for £10 skype credit. I seldom use Skype and when I do its just for the free web cam service. I never purchase credit.
I also had an email from skype to say my purchase has been successful. Strangely the Skype account in question was one I signed up for back in 2007 and forgot about. I have a newer account so I cant understand how or why they got into this old dormant account. So I had to retrieve the password though my email account to get access. When I did I saw that the account has been used to make calls to a mobile phone in the Ivory coast.
What's strange is that in order to get the payment through they must ave known my paypal password as well. My paypal password gets changes regularly and was only recently changed to a new one before this happened.
I changed the passwords to all my most important stuff (email paypal etc) straight away.
What is really strange is that I have never had anything like this happen to me before, but this week I had been using a VPN for the first time (Giganews) to connect to the internet. It was a free trial so I thought I would give it a go to see what it was like, more out of curiosity than anything else. Iv stopped
Im really worried that someone had my paypal password and worry what else they might have. Am I now open to further attacks or identity theft or the likes?
I had only recently done a full refresh of my laptop and pc so I doubt it could be because of a virus.
Please advice. Thanks.

[#2]

Quote

I had only recently done a full refresh of my laptop and pc so I doubt it could be because of a virus.

First I would report it to paypal and MS, but define what you mean by refresh?  New pc and laptop or windows reinstall on both.  If a new pc/laptop how did you dispose of the old ones? only safe way to safely dispose of a hard drive from either is with a hammer.

[#3]

Both PayPal and MS support 2 factor auth, I'd suggest enabling it (and on any other account/service that offers it)

[#4]

Genuine emails from PayPal will always address you by name, so if you get one that addresses you as "Dear PayPal User" then it will be a phishing attempt and should be ignored / deleted / reported to PayPal as you see fit.

[#5]

Quote from: Jaggies

Genuine emails from PayPal will always address you by name

This is no longer a good way to make sure it isn't a scam email. I buy a lot of stuff from abroad and it appears that the retailers are selling customer information to the scammers.
I've had quite a few Bank / Paypal / Apple scam emails addressing me by my full name.

[#6]

Just to make it clear, this was defiantly NOT an email fishing attack. Perhaps I didn't explain myself very well. I only mentioned the email's from Paypal and Skype because they were what drew my attention to the situation. They were legitimate receipt emails. I get tonnes of them every week as I buy a lot off ebay. I'm very familiar with this. When I logged into my paypal account (by opening a new browser tab and going to paypal.co.uk, not by clicking a link in the one of the email's!), there were 2 separate payments to Skype for £10.
Someone had got access to an OLD Skype account (I hadn't used since 2007) and been able to purchase credit which they have then used to phone the Ivory Coast.
Paypal wont accept it as fraudulent use because my Paypal account was linked to the Skype account already. HOWEVER, in order to purchase the credit via Skype they would have been prompted to enter my Paypal password at the check out stage.
Skype asked me to verify my account by filling out a questionnaire full of questions which I was unable to answer such as name 3 contacts in your contacts list...I don't have any! I'm not even sure what name I used when I signed up for the account. I was only 16 in 2007 and I used to use stupid made up names when signing up for accounts on line. So they are using this to get out of refunding the payment.
What I cant get my head around is if they had my Paypal password why they only used it to buy credit for Skype? And why an old dormant Skype account?
I have 2 possible explanations for how I got hacked. Its either something to do with accessing the internet through a VPN last week or its to do with a Virus I had on my Desktop PC a couple of weeks ago which resulted in me having to format the hard drive and reinstall Windows. If it was the virus on my desktop then Luckily I don't use it for much else than playing games and watching films.

[#7]

Wondering if Skype is using a paypal payment method same as Steam added late last year.  There is a way to pay for items from a steam client which does not require you to login to the paypal site, its automatic.
If you can gain access to it, remove any payment details you have from the Skype account and tell Paypal that it was from an old account Skype account you suspect has been hacked

[#8]

Quote from: speachy

Paypal wont accept it as fraudulent use because my Paypal account was linked to the Skype account already.

I would get back to Paypal and remind them that as you did not make or authorise any such transaction it IS FRAUDULENT and you expect them to fully investigate the matter and block any further possible transactions associated with said account.
If you haven't already, I suggest you change your passwords for Paypal and your other Skype account and make sure you aren't using the same passwords.
I would also get back to Skype/MS and tell them you want that old Skype account deleting. You should not have to answer their "verification" questions - details of which you can no longer remember. The fact that it is linked to a Paypal account that you CAN PROVE is yours and transactions that have been made ARE FRAUDULENT as they haven't be made or authorised by you. The fact they they may be arguing about whether they will make any refund is totally irrelevant, that is a secondary issue.
Stopping any further fraud and mis-use is the primary objective. Significantly larger sums of money may be involved in the future is this is not done.