https://twitter.com/RealKidPoker/status/1331475856359735299
https://twitter.com/Erik_Seidel/status/1331329401611542529
So obviously this isn't a coincidence. Seidel and Negreanu were clearly targeted due to being prominent (and assumed wealthy) poker pros.
But how did it happen? Could be in a variety of ways, which I'll list from most likely to least likely:
1) Phishing attack: Often scammers will send fake e-mails from PayPal or Venmo, with a link to "login" to resolve a phony problem. Then the victims enter their login info, which is promptly stolen by the criminals. Then they are given some kind of non-threatening screen stating that the problem has been resolved (or something else making them forget that anything notable happened), and the thieves go to town.
2) Stolen password from previous hack: Negreanu and Seidel perhaps used the same e-mail/password combo on Venmo as they have on other sites which were previously hacked, thus allowing those same hackers (or ones who viewed a data dump of those hacks) to get this info.
3) Social engineering attack: Venmo customer support was convinced by the criminals to allow access to Negreanu and Seidel's accounts (in separate phone calls or e-mails).
4) Email compromise: Their e-mail was accessed in some way by the criminals (usually by phishing, but sometimes other ways), and this allowed their password to be reset (and the notification of it being reset deleted).
5) Keylogger attack: These guys used a computer at some point -- perhaps their own, perhaps someone else's -- which logged their key presses, and the criminals obtained their Venmo password this way.
6) Insider attack: Someone at Venmo enabled access to these accounts by criminal friends.
7) Exploit/hacking of Venmo: Someone has a way to exploit Venmo itself to break into accounts.
Here are my tips to prevent yourself from becoming a victim:
1) You gotta keep 'em separated! Always use separate passwords for different sites, even if they vary by only a little.
2) Don't click links. Never click on links from payment services in e-mail. Always go to the URL directly.
3) Don't hold a balance on Venmo or PayPal. Always cash it out. This is protection against both hacking and unfair confiscation. Any money stolen through your bank can be recovered fairly easily. Any money stolen directly out of your Venmo/PayPal balance can be very difficult to recover, and you have zero power in the situation.
4) Use a different e-mail for these services than you normally use for regular correspondences with people.
5) Lock 'em up! Set up maximum security, such as two-layer verification before payments are allowed.
Reply With Quote
Originally Posted by Dan Druff
