• If you enjoy the forum please consider supporting it by signing up for a NES Membership  The benefits pay for the membership many times over.

Possible GPAL Security Breach?

Joined
Mar 31, 2006
Messages
9,249
Likes
2,824
Location
Southcoast of PRM
Feedback: 40 / 0 / 0
I just received the following email from Gpal. I don't know quite what to make of it. Does anyone have any more info? BTW, this is exactly how it appeared in my email program.

Content-type: text/html; charset=iso-8859-1

From: "GPal, Inc." <[email protected]>

Date: Mon, 04 Oct 2010 20:48:27 -0700

X-Priority: 3

X-MSMail-Priority: High

X-Mailer: GPal Users

Message-Id: <[email protected]>
X-Antivirus: avast! (VPS 101004-1, 10/04/2010), Inbound message
X-Antivirus-Status: Clean


<span style="font-family: arial, helvetica, sans-serif;font-size: 13px"><img src="http://img.cdn.gunpal.net/images/gpal/gpal_logo.jpg" width="154" height="60" /><br />

<br />

Dear XXXXXXXXXX, <br />

<br />

At GPal, we take our responsibility to provide you with a fast and safe way to transact on the web very seriously.<br />

<br />

It has come to our attention that several GPal users have been contacted on phone numbers not listed at GPal by persons with blocked caller-IDs, claiming to be our CEO Ben Cannon leaving derogatory or even threatening messages, or asking for user information. Â These sorts of attacks may be an attempt to gain your personal information in order to access your GPal account.<br />

<br />

GPal has already initiated legal action against the perpetrators involved, however if you have received any such calls or other suspicious contact, please report it and provide all information you have to [email protected] immediately.<br />

<br />

Remember: GPal will never contact you on any phone number not listed on your GPal account, or any email address not listed on your account.<br />

<br />

When we do contact you, it will be from [email protected] or our 800 number 800.813.GPAL (800.813.4725) Â Please report any other contact from anyone claiming to be GPal directly to us at [email protected] and/or your local law enforcement and do not divulge any personal information.<br />

<br />

A reminder, GPal representatives will never ask you for your password via email or phone.<br />

<br />

Thank you for using GPal.<br />

<br />

Legal Team<br />

GPal, Inc.</span>
 
Just got it as well. The bad formatting is just your email not handling it nicely...Gmail handles it fine.

As for the content, despite the perceived public problems with gPal, there have apparently been some cloak-and-dagger, spy novel, B.S. goings on by one or more parties in an attempt to make them look bad. Oleg Volk had some info if you dig back in his LiveJournal posts from the past month or so.
 
Gpal is toast. Thousands of people have been trying to get their money with little hope of success.
If you try to send money via Gpal it will most likely be stolen.

Jack
 
Gpal is toast. Thousands of people have been trying to get their money with little hope of success.
If you try to send money via Gpal it will most likely be stolen.

Jack

Yep, they still owe me money. It's "only" been like 3 months now..... Stay away from gpal.
 
You should read about these guys on other forums. Apparently, they are on death's door. Thousands of people are owed hundreds of thousands of dollars and are unable to get their money. One of the founders has been calling customers and leaving threatening voice mails. Their business license has been suspended in CA and they lied about ever being a corporation--they are not, just a "DBA". People cannot get in touch with support, either by e-mail or phone. And finally, their user agreement actually says that they are not liable for any "failures" to actually get you your money!

I have a feeling that they used deposits/transaction money to pay their salaries and/or buy equipment or lease office space. And now, they are in the hole, somewhat like a Ponzi scheme.
 
You should read about these guys on other forums. Apparently, they are on death's door. Thousands of people are owed hundreds of thousands of dollars and are unable to get their money. One of the founders has been calling customers and leaving threatening voice mails. Their business license has been suspended in CA and they lied about ever being a corporation--they are not, just a "DBA". People cannot get in touch with support, either by e-mail or phone. And finally, their user agreement actually says that they are not liable for any "failures" to actually get you your money!

I have a feeling that they used deposits/transaction money to pay their salaries and/or buy equipment or lease office space. And now, they are in the hole, somewhat like a Ponzi scheme.

If I were burnt by them and what you posted above is true, then I'd be filing a criminal complaint against them for larceny, wire fraud, etc. as well as filing a complaint with the CA AG! It's no time to be nice to anyone who steals from you.

When I got the Email from them, I was immediately wondering if they did that to take the heat off their own actions. I had set up an account but never gave them any cc numbers, bank info or used it.

Just one person's opinion.
 
Thanks for the replies, gentlemen. I thought the message was a little unclear. If people are getting calls from someone supposedly from Gpal, then I would have assumed their database had been hacked into, otherwise how would the caller have gotten the subscriber's phone numbers? Usually, when something like this happens, the email states clearly that your personal information may have been compromised. This email is kind of unclear about whether that happened.

It almost sounds like this is an internal problem with the folks running Gpal.


Just got it as well. The bad formatting is just your email not handling it nicely...Gmail handles it fine.
As for the content, despite the perceived public problems with gPal, there have apparently been some cloak-and-dagger, spy novel, B.S. goings on by one or more parties in an attempt to make them look bad. Oleg Volk had some info if you dig back in his LiveJournal posts from the past month or so.

You're correct about the formatting. I have html turned off for that account, so it should have come through as plain text. Usually the text shows up minus all the formatting commands. I don't know why it didn't with this email. [hmmm]

I'll go back and read through Volk's posts to get the back story.

[SIGH] I was really hoping Gpal would be a good alternative to Paypal. [sad]
 
I had an account, unlinked my account info a while ago and I'm pretty diligent about looking at my statements.
 
I'm not entirely certain that Gpal is a ponzi scheme. There's some evidence that their current problems are not of their own making. If proven out, that would be good for them. However, how they've chosen to deal publicly with their problems is entirely a different matter.
 
I'm not entirely certain that Gpal is a ponzi scheme. There's some evidence that their current problems are not of their own making. If proven out, that would be good for them. However, how they've chosen to deal publicly with their problems is entirely a different matter.

I think they're just incompetent. I don't see any reason to think it's criminal.
 
Last edited:
I never suggested that it is a real ponzi scheme. I'm just saying that it sounds like they are having trouble paying out because they (stupidly) used some of their deposits to fund necessary, day-to-day operations. So now they are in the hole. This is just one theory. Its also entirely possible that they are just incompetent beyond belief, and have been sitting on people's money for months--but I doubt it.
 
I never suggested that it is a real ponzi scheme. I'm just saying that it sounds like they are having trouble paying out because they (stupidly) used some of their deposits to fund necessary, day-to-day operations. So now they are in the hole. This is just one theory. Its also entirely possible that they are just incompetent beyond belief, and have been sitting on people's money for months--but I doubt it.

Just in case you didn't understand. Your description of what they are doing is pretty much the definition of a ponzi scheme and is illegal. (I italicized, bolded, and underlined in case you didn't notice)

The botom line is that people have been waiting months to get paid. You try to withdraw money, it shows the transaction went through, so your gpal balance may end up at zero, then the money never appears in your bank account.

Those that have threatened with lawyers or make enough noise get paid.

Further, digging into the backgrounds of the founders has revealed that they are not who they say they are. Their resume's are largely fabricated. In fact the executive team link on the web site is now gone so you can't even try to flush out the lies.

And no. They haven't been sitting on people's money for months. The money is gone. Sorry, you can't get paid until some other sap deposits money into the system. oops. its that whole ponzi thing all over again.
 
Just in case you didn't understand. Your description of what they are doing is pretty much the definition of a ponzi scheme and is illegal. (I italicized, bolded, and underlined in case you didn't notice)

My take on the scenario:

Suppose you are running a service like Gpal with every intent of being honest. You are not generating revenue as rapidly as expected, and also may experience losses from some fraud (as the defense of "but we gave your money to someone else" is unlikely to free you of the obligation to your customer).

What do you do?

- File for bankruptcy, treating the customer funds as a sacred escrow?

- Try for another round of venture financing?

- Use some of the customer funds for operating expenses, "knowing" you will return the escrow holdings to full funding before anyone finds out .... and use the amount that you do have to grease squeaky wheels; pay customers who present a credible threat of an enforcement action; etc.

It would take an exceptionally honest management team to resist the temptation to try to keep the business afloat using the funds provided by their unsecured creditors (ie, the customers), particularly if legal counsel advised them that doing so was not illegal and they were not under any obligation to maintain segregated and escrowed funds for this obligation of the firm.

My guess is that they had a choice of fold or go ponzi and hope it works out.

Customers of any of these payment systems forget one thing - their role is "unsecured creditor", not "depositor" :).
 
I will continue to use PayPal. I just don't post what the funds were used to buy. Never had a problem!
 
Just in case you didn't understand. Your description of what they are doing is pretty much the definition of a ponzi scheme and is illegal.

Well, I partly agree. Although, it doesn't actually meet the definition of a Ponzi scheme because GPal doesn't promise investment returns for keeping your money with them. What they may have done is more along the lines of what regular banks do everyday: use customer deposits. But unlike banks, GPal does not have to meet minimum reserve/capital requirements.

Truth is, 99% of Ponzi schemes start out as honest business. But then the owner is "forced" to go Ponzi to raise capital to keep his business afloat. And founders, naturally, are always inclined to believe that just one more deal will turn the company around...
 
Last edited:
I read an interesting take on this by a private investigator in CA. It's been mirrored here:

Link!
The short version of it is that the CEO had liens from past credit card bills, and that the credit cards may have seized GPALs' customers deposits when they went into a bank account he opened.

I do not know if any of this is true, but it sounds plausible. It was posted on Calguns, where, surprise, I think it's been deleted.
 
I read an interesting take on this by a private investigator in CA. It's been mirrored here:

Link!
The short version of it is that the CEO had liens from past credit card bills, and that the credit cards may have seized GPALs' customers deposits when they went into a bank account he opened.

I do not know if any of this is true, but it sounds plausible. It was posted on Calguns, where, surprise, I think it's been deleted.

Even if this is true, this should be of no concern nor a reason for forgiveness by those that have been wrongfully screwed out of their money.
 
Well, I partly agree. Although, it doesn't actually meet the definition of a Ponzi scheme because GPal doesn't promise investment returns for keeping your money with them. What they may have done is more along the lines of what regular banks do everyday: use customer deposits. But unlike banks, GPal does not have to meet minimum reserve/capital requirements.

In some businesses, the provider is required to escrow the funds - either explicitly or implicitly. In the case of a MA residential rental, the funds must be deposited into a separate account. In the case of a contractor, funds given as the down payment for materials must be spent on materials - it's fraud to treat such deposits as "general revenue" and then consider the promise to buy materials for the customer job as a separate unsecured obligation. It would be interesting to see how state and federal law applies to the Gpal handling of customer funds.


The short version of it is that the CEO had liens from past credit card bills, and that the credit cards may have seized GPALs' customers deposits when they went into a bank account he opened.
NEVER deposit money into an account at a bank where you are in arrears, or if there is a billing dispute with said bank. Many bank contracts give an explicit right of offset, and some banks might even assert such a right even in the absence of a specific contractual provision. (But, from reading the linked article, it could have been a cort ordered seizure and not an exercise of right of offset)
 
Last edited:
My take on the scenario:

Suppose you are running a service like Gpal with every intent of being honest. You are not generating revenue as rapidly as expected, and also may experience losses from some fraud (as the defense of "but we gave your money to someone else" is unlikely to free you of the obligation to your customer).

What do you do?

- File for bankruptcy, treating the customer funds as a sacred escrow?

- Try for another round of venture financing?

- Use some of the customer funds for operating expenses, "knowing" you will return the escrow holdings to full funding before anyone finds out .... and use the amount that you do have to grease squeaky wheels; pay customers who present a credible threat of an enforcement action; etc.

It would take an exceptionally honest management team to resist the temptation to try to keep the business afloat using the funds provided by their unsecured creditors (ie, the customers), particularly if legal counsel advised them that doing so was not illegal and they were not under any obligation to maintain segregated and escrowed funds for this obligation of the firm.

My guess is that they had a choice of fold or go ponzi and hope it works out.

Customers of any of these payment systems forget one thing - their role is "unsecured creditor", not "depositor" :).


Rob,
The legal way is that the money goes into some kind of escrow account. You are able only to withdraw the fees that are owed to you. So the money is isolated from any business problems that you may encounter. In a scenario that you presented using customer funds to fund operations is not only unethical, but illegal. Its a slippery slope .

But lets take your example to its apparent outcome. You continue to use "escrow" money to fund operations until there isn't any of that anymore either. You can't pay withdrawls so you put them off until some other unwitting sap deposits money. Then you use some of it to pay for operations and some of it to pay the guy threatening a lawsuit.

You are now illiquid until the next sheep comes in to get fleeced.

I don't like paypal's politics, I don't like paypal's vendor policies. But at least they are not screwing keeping money that is not theirs. (plenty of vendors have been screwed by policies that favor the buyer too heavily. When a vendor is screwed on PayPal, the money in question went back to the buyer. It didn't go to fund paypal's operations)

I've often thought of setting up an online transactional account with Mastercard or Visa. I'm told it can be as cheap as $7/month.
 
Well, I partly agree. Although, it doesn't actually meet the definition of a Ponzi scheme because GPal doesn't promise investment returns for keeping your money with them. What they may have done is more along the lines of what regular banks do everyday: use customer deposits. But unlike banks, GPal does not have to meet minimum reserve/capital requirements.

(cough cough) and without federal insurance. If my bank plays fast and loose with its fractional reserves and fails because of it, I'm covered by the FDIC up to $250,000 per financial institution.

So if I use two banks I'm covered for half a million. And who keeps that kind of cash around unless yo are very very well off. for me, anything over 6 months of cash reserves is invested in something.
 
Last edited:
Back
Top Bottom