Paypal bug

cluelessPHP

So basically you can make a primary account with your bank details and a second account then bounce money from one to the other, then withdraw the money, I'm not sure of the cap on this but testing indicates if you were crazy enough you could put a bank account in a massive amounts of red and run like hell

dalecosp

Dad was a banker. When they started opening casinos here in Missouri (on riverboats) in the 1980's, they caught an old geezer depositing empty envelopes in the ATM (automatic teller machine) and making ATM "withdrawals" against the same account so he could go play more slot machines ... got him with about $9K in "stolen funds" IIRC...

Needless to say, ATM's don't work that way anymore ...

cluelessPHP

I had assumed it wouldn't work either, maybe an oversight at paypal? If and idiot like me can figure it out, I'm sure others have/can/will

NogDog

If anyone could figure it out, then it probably doesn't work like you imagine, as I'd think someone would have already tried, and they would have fixed it. 🙂

cluelessPHP

NogDog;11056731 wrote:
If anyone could figure it out, then it probably doesn't work like you imagine, as I'd think someone would have already tried, and they would have fixed it. 🙂

Well here are two accounts, doing exactly as I described

[ATTACH]5361[/ATTACH]

proof.png

NogDog

I'll admit that (a) I have not used PayPal in a long time (multiple years), and (b) probably am not following exactly what you are saying you're doing. But at some point before you really get any money out of them, it will come from your bank -- and your bank will not transfer more money to them than you have.

cluelessPHP

It seems to work, I looked at my bank account seems a strange thing

NogDog

cluelessPHP;11056739 wrote:
It seems to work, I looked at my bank account seems a strange thing

Maybe you could make a little money in good conscience by contacting PayPal and telling them that for a reward, you'll alert them to a problem that could otherwise cause them a lot of grief. 🙂

cluelessPHP

NogDog;11056749 wrote:
Maybe you could make a little money in good conscience by contacting PayPal and telling them that for a reward, you'll alert them to a problem that could otherwise cause them a lot of grief. 🙂

Yep. Had thought of that but all the bug reporting links I found seem dead, so I went back to arguing with SQL, ajax and JSON

It's almost tempting to grab as much as I can and run away to China or somewhere

cluelessPHP

Well it could be a coincidence, but I noticed after an email ppbugbounty@paypal.com, they changed the way transfers are done slightly :p

Although if it was because of my email my take away from this is don't report just abuse 🆒