Unauthorized charge to PAYPAL STEAM GAMES, GB

[[SHUSH] Mordai]

Hi! Today, i took a look at my phone, and there were more then 5 SMS's about Debit Card charges, with the following infos:
PAYPAL *STEAM GAMES, GB 35314369001 PAYPAL
........... and so more 10 SMS's .............

So, first of all, i DIDNT buy anything for a half year. Was that the real STEAM, and when yes WHY? How can i find out, what happened?
Thx for your help!

[wuddih]

https://help.steampowered.com/en/wizard/HelpWithPurchase
"I have charges from Steam that I didn't make"
etc.

you should secure your accounts. change passwords etc.

[[SHUSH] Mordai]

Okay, but how can something happend like this. I have Steam Guard enabled, have a strong password and a deleted credit card details.

[ KARR™]

Check your login history https://help.steampowered.com/en/accountdata/SteamLoginHistory see if anything looks wrong.

[[SHUSH] Mordai]

Hmmm. There is one from NY: (its interesting, because i live in Hungary)
May 1, 2018 @ 1:07pm CEST - 16 - US - New York City - NY
But here, there arent any Logg Off time info.

[wuddih]

well, that was in may.

but in general, i dont see the scope, from my perspective that could still be "just" a breach on your paypal account only and well .. so sad that it is, Steam is an easy accessible method to scatter and launder stolen money.

i really meant all your accounts. if you used any password on more then one account, then this is already a security risk and if f.e. your email account is breached, then steam guard over email is completely useless.

a strong password does not really mean anything if you use it in more then once place. one database of a service you use gets breached, even when the data and password is encrypted, it does not take long in most cases to revert it back into clear text and then use it to attack other possible services.

[[SHUSH] Mordai]

Well... I always tried to give other passwords and use two step auth, or guard...
So, an interesting think is, that the amounts of charges arent too different, there are 6x5,23 EUR and one bigger with 26,23 EUR.

[Supafly]

DON'T click and use any link in those messages. You can see if purchases were really made or if those are just phishing messages using either option below

1. Check your purchase history
https://help.steampowered.com/en/wizard/HelpWithPurchase

2. Login to Paypal and check if these transactions are real.

[[SHUSH] Mordai]

The more interesting part, is that I DONT have PayPal account. I think, my card is added to someones PayPal acount.

[Phoenix]

The most probable option is that someone just got access to your Paypal account, thus making purchases from your Paypal to his own Steam account, but stupid enough to forget to change Paypal mobile number for SMS. (or, there might be Paypal won't allow such instant change because of security reasons).

Change your Paypal password. Check its balance history to ensure if unauthorized purchases were made. Open Paypal support ticket for unauthorized access to your account. Keep these SMS messages (they might contain useful info for Paypal support).

EDIT: if you don't have a Paypal, your credit card is probably, indeed, compromised. Call your bank to ensure if such transactions were made. If so, you can debate them. But you probably have to block your card and get a new one.

[[SHUSH] Mordai]

Thank for all, but as i said before, i dont have PayPal account. Is this possible, that when i bought something with the help of PayPal (User Interface), but without PayPal account, then someones stole my credentails?

[Supafly]

Originally posted by Mordai HUN:

The more interesting part, is that I DONT have PayPal account. I think, my card is added to someones PayPal acount.

So if you DON'T have a Paypal account, common sense should already tell you the messages are full of ****.

Even if a phishing message get several things right, luck or harvested data, making them even more credible. Check the information is correct using other means.

i.e.
Message stating purchase using.
Any real method you use.

Login/phone/message that company directly to confirm if the transaction took place.

If it did happen you have identified fruadulent activity on you account with the company that with block transactions and you'll continue dealing with them.

Or

If it didn't. You know its a typical phishing message and can ignore.

For starters any REAL company will address you by NAME. username or real name. Just ignore and delete every message that don't use either of them. Makes me laugh when I get obvious phishing messgaes that don't address me at all. No Dear, hi, hello etc. Or use Dear Client/Customer/email adrdess. These are obvious fakes. Seriously I have 2 email accounts and both of them use my first and last name yet the scammers don't even think to use them when they address me because the same message is Spammed to 100's or more people.

[wuddih]

check if there are any charges on your steam account.

if not.
call your bank to double check if those charges happend and if so, claim those charges as unauthorized. i dont know if you also have to go to the police. your bank can help your with that.

Originally posted by Mordai HUN:

Is this possible, that when i bought something with the help of PayPal (User Interface), but without PayPal account, then someones stole my credentails?

yes that is possible.

[[SHUSH] Mordai]

Okay, the messages are from the official OTP Bank address, i know it, because i have recieved more messages from this address, so this is a trusted source.

[Phoenix]

It's enough to have you name, card number and CVC card code to make some purchases.
So unless you have a gamer child/wife/husband/whatever who could use your card to purchase something, your card is probably compromised. Call your bank immediately, check if such purchases were made. If so, block your card and get yourself a new one. Claim these transactions as unauthorized.

[[SHUSH] Mordai]

Okay, thank you all for this quick help! I wait for the Steam Help Support answer, and I'll do my best to get my money back