PayPal to Offer Fobs to Increase Password Security

Announcement comes same weekend eBay revealed 3rd Party Checkout Glitch

In an effort to beef up security and thwart phishing, PayPal announced today that it is testing a password-generating key fob as a layer of added costumer protection. In an odd coincidence of timing, word of the PayPal Security Key initiative was announced just days after eBay announced that a glitch had prevented some users from transferring funds to and from their PayPal accounts.

The new security device, which has been been developed by digital security firm Verisign, displays a new one-time password in the form of a six-digit code every 30 seconds.

PayPal has been piloting the authentication device with employees and expects to start trials with customers in the next month. According to press reports the key ring will cost $5.00 for personal PayPal accounts, but will be free for business customers.

The device is designed to protect customers against fraudulent phishing scams. Research released by IT security firm Sophos in August last year found that over 75% of all phishing e-mails target users of PayPal or its parent company eBay. A separate study conducted by Gartner also found that cyber criminals are shifting away from attacking online banks directly and are targeting brands such as PayPal and eBay more often.

PayPal said that the technology is not foolproof and should be seen as just another layer of protection. Spokeswoman Sara Bettencourt told reporters the new device will provide customers with "another layer of protection" so if a fraudulent party got hold of a person's username and password, they still wouldn't be able to get into the PayPal account.

Meanwhile, eBay announced that the funds transfer problem had affected only transactions going through eBay third-party Checkout.

One PayPal user told the San Jose Mercury-News that when he tried to withdraw money on Sunday, he received a message requesting that he complete a registration process and confirm his primary e-mail address. The message said "If you need your e-mail confirmation number resent, click on the new confirmation number link at the bottom of this page."