Takeover of Brian Krebs' PayPal account illustrates why authentication via static identifiers (like SSN and DOB) is highly vulnerable to identity thieves
2016 Reality: Lazy Authentication Still the Norm — My PayPal account was hacked on Christmas Eve.
Context & Ripple Effects
Brian Krebs woke up on Christmas Eve to find his own PayPal account seized by attackers who could answer the security questions — a pointed case study, since Krebs has spent his career documenting exactly this failure mode. The takeover worked because PayPal, like much of the financial system, treats static identifiers such as SSN and date of birth as secrets, when they are in fact widely leaked and trivially purchasable.
This was not an isolated lapse but one node in a long arc of knowledge-based authentication failures: the IRS PIN system protecting 724K breach victims relied on the same KBA technology used in the original breach, SSNs plus birthdates later unlocked records at the US FAFSA site, and Experian's authentication flow kept showing hijacked-account reports well into 2022. The pattern held through PayPal's own December 2022 credential-stuffing incident exposing ~35K users' SSNs and addresses.
First-order effects
- PayPal customers whose recovery flows hinge on SSN/DOB answers are exposed right now: anyone holding those leaked identifiers can pass verification and seize the account before the real owner can intervene.
- Krebs himself lost control of his account on December 24, demonstrating that even security-literate users cannot opt out of a weak backend they don't control.
Second-order effects
- Credit bureaus become the force multiplier: Experian's flaw letting attackers pull anyone's full credit report from name, address, birthday, and SSN hands thieves precisely the answers other sites' KBA challenges demand.
- Government portals face the same squeeze — the IRS and FAFSA, both built on static-identifier checks, turn public benefit access into an attack surface that leaks further data usable against private-sector accounts.
Third-order effects
- If the pattern holds, regulators and payment platforms are pushed to retire knowledge-based authentication entirely, shifting identity assurance toward out-of-band and device-bound factors rather than data that has already been breached.
- The deeper structural problem is circularity: breached SSNs feed takeovers, takeovers yield more personal data, and that data authenticates the next round — meaning any institution still treating static identifiers as secrets inherits every other institution's breaches.
The trend: Knowledge-based authentication anchored to SSNs and birthdates persists across banks, bureaus, and government sites years after repeated takeovers prove those identifiers function as attacker credentials, not user secrets.