Using Skype Manager? no? Expect incoming fraud

I have been using Skype ever since it came out, so I know my stuff.

I know how to write strong passwords, how to use smart security questions and how to – most importantly – avoid Phishing attempts on my Skype account.

But all that didn’t help me avoid a Skype mishap (or more bluntly as a friend said – Skype f*ckup).

It all started Saturday late at night (about 2am GMT), when I started receiving emails in Mandarin from Skype, my immediate thought was fraud, a phishing attempt, so I ignored it. But then I noticed I got also emails from Paypal with charges from Skype for 100$ 200$ 300$, and I was worried, was my account hacked?

I immediately went to PayPal and disconnected my authorization to Skype, called in Transaction Dispute on PayPal and then went on to look at my Skype account.

I looked into the recent logons to my account – nothing.

I looked into email changes, or passwords – nothing.

I couldn’t figure out how the thing got to where it was, and then I noticed, I have become a Skype Manager – wow I was promoted and I didn’t even send in my CV.

Yeah, joke aside, Skype Manager, is a service Skype gives to businesses to allow one person to buy Skype Credit and other people to use that Credit to make calls. A great idea, but the execution is poor.

The service appears to have been launched in 2012, and a few weeks after that, fraud started popping up. The how is very simple and so stupid it shameful for Skype to not have fixed this, since it was first reported (which I found) on the 21st of Jan 2012 on the Skype forum.

Apparently having this very common combinations of:
1) Auto-charge PayPal
2) Never used Skype Manager
3) Never setup a Work email for Skype

Makes it possible for someone to:
1) Setup you as a Skype Manager
2) Setup a new work email on some obscure service (mailinator was used in my case), and have all Skype emails for confirmations sent there

Yes, they don’t need to know anything BESIDE the Skype Call name of your account – which is easy to get using Skype Search.

Once you have become a Skype Manager, “you” can add users to the group you are managing – they don’t need to logon as all they need to do is use the (email) link you get to the newly assigned Work Email, yes, it doesn’t confirm the password – smart ha?

The users added to your Skype Manager can now take the Credit (its not money, it just call credits) and call anywhere they want.

Why this bug / feature not been fixed/addressed since the first time it was made public on the Skype Forum (probably was exploited before then), is anyone’s guess, talking to the Fraud department of Skype – he mainly stated that I should:
1) Change my password for Skype – yes, that would have helped nothing in this case
2) Make sure I authorize Skype only on trustworthy devices

The bottom line, Skype users, make sure:
1) You have configured your Skype Manager – if you are using Auto-Charge feature – I have disabled my Auto-Charge and PayPal authorization since then, and don’t plan on enabling it anytime (ever)
2) You have configured your Skype Work email – yes, if its unset, anyone can change it – without needing to know your current password – is this company a PCI authorized company? :D

If you have more insight on the matter, let me know

- Noam

  • Guest

    This happened to me today.  FML.  Skype was no help, but PayPal cancelled all of the charges.  Getting rid of my Skype account, which I hadn’t used since 2009 anyway.  Thanks for the excellent article!

  • José Godínez

    This was published on June 24th 2012, surely has been around before than that and Skype has done nothing to prevent it.

    I’ve just been screwed almost the exact same way, with two exceptions:
    I never autorized the Auto-charge (I guess the thief kindly did it for me).
    And the charges were made directly to a credit card I used to buy credit in the past only if needed, but indeed was in the Skype database.

    I used Skype when being abroad, to save some money when calling back home. Never used it when I was in my country (Mexico). I have been in home for nearly 3 months, I didin’t touch Skype at all (I have it installed only in my smart-phone and disabled unless abroad); yesterday sudenly I started recieving cellphone bank notifications of Skype charges, when I checked my e-mail there they were, two notifications in mandarin of unautorized (at least not by me) charges.

    I called the bank and they had to cancel my credit card to prevent any further charges while investigating the matter (I didn’t know at that moment that actually Skype was making the charges). I hope the bank refuses the charges and Skype doesn’t get the money since I caught and report them just a few minutes after being made.

    After this unpleasant experience, I’m done with Skype; William Henry Gates the III can do whatever he pleases with his windows messenger substitute.
    Thanks NOAM for this article!

  • casusanima

    Just happened to me yesterday… Apparently I will be contacted by skype … Lets see I am on the phone now with Visa …

  • casusanima

    Skype actually refunded my theft ! :) Still scary but anyway, well done CS !