January 19, 2024 at 03:28PM
Many Payoneer users in Argentina woke up to find their 2FA-protected accounts hacked, with funds stolen after receiving SMS OTP codes while sleeping. Suspected hacking methods include a potential Movistar data leak or a breached SMS provider. Payoneer has not provided specific answers but acknowledged the fraud and advised users to withdraw funds or disable SMS-based 2FA.
Based on the meeting notes, it appears that numerous Payoneer users in Argentina have reported hacked accounts and stolen funds, even though their accounts were protected with two-factor authentication (2FA). The users received suspicious SMS requests for password resets and OTP codes, which they did not grant or interact with, but still lost their funds. The stolen funds were sent to an unknown email address at the 163.com domain. There are suspicions that a recent Movistar data leak may be behind the account hacks, or that the SMS provider used to deliver OTP codes was breached.
There seems to be a dispute between affected users and Payoneer, with Payoneer alleging that the users clicked on phishing links and entered their login details, while the users deny doing so. There are concerns about potential vulnerabilities in Payoneer’s system, as it relies on SMS-based 2FA and has a password recovery process that only requires an SMS code. Some users are advised to withdraw funds from their accounts or disable SMS-based 2FA and reset their account password until the situation is resolved.
In summary, it is evident that there are significant security concerns with Payoneer accounts in Argentina, and both Payoneer and Movistar are under public scrutiny regarding the reported hacks.
It seems like a critical investigation is needed to identify the source of the vulnerabilities and address the concerns raised by the affected users. Additionally, the potential impact on users in other countries using Payoneer should also be a priority for further examination.