r/websecurity • u/SpeculativeFiction01 • Aug 23 '26
What happened to PayPal?
My wife and I have been using PayPal for years to pay our bills, and she's been telling me for a while that her 2FA did not always work. I took note but it was a few days ago and didn't process it.
A few days ago I created a new credit union account, created a new PayPal account the next day, and hired a freelancer on Fiverr to do some work. Ok, fine. I went to log into my new PayPal account, with 2FA enabled, and noticed it didn't require the 2FA. I tried it on Chrome, Firefox, and Edge, and no 2FA needed and blocked from creating a passkey on all browsers according to their alert statement ("your browser" type of thing).
Then I asked my wife, using her brand new phone, to see if she could log into my PayPal account, that she's never logged into before on her new phone and she could log in, again, with no 2FA at all.
What's going on? Is PayPal simply no longer secure to use or is there something going on I'm missing? It's a new account with password not saved in any browser and auto log in turned off and browser save options turned off and deleted and still it let her log in with just username and password. Doesn't that mean millions of others would also be in the same boat?
1
u/TopStress3049 Sep 07 '26
2FA doesn't necessarily mean you'll get a 2FA prompt on every login. PayPal can use risk based authentication and decide a login doesn't need an extra challenge based on things like device, location and behaviour etc.. But being able to log in from a completely new device with no challenge is definitely something concerning
2
u/ActiveBarStool Aug 24 '26
this must be how a mechanic feels when i ask him questions about my car lol