My wife did not click a phishing link.

She did not share her password.

She did not approve an unexpected login or read an MFA code to a stranger.

In fact, she never interacted with the attacker at all.

Her PayPal account was still taken over.

The opening was a phone number she had stopped using years earlier.

According to multiple PayPal fraud representatives, the attacker reset her password using two recovery checks: an SMS message and a WhatsApp message.

Both were tied to the same retired phone number.

That is the part of this story that should matter to anyone who has ever changed a phone number, retired an email address, replaced a credit card, or simply forgotten about an old online account.

It should also matter to the people designing authentication, fraud, and recovery systems.

I have spent much of my career in CIO and cybersecurity leadership roles. When this happened at home, the incident responder in me took over. I wanted to know four things: What happened? How did the attacker get in? What persistence had they established? And what had to change so it could not happen again?

What followed became a useful reminder that security failures are rarely about one bad password. They are often about old identity data, weak recovery logic, and the gap between restoring a user’s access and actually removing an adversary from an account.

The forgotten number

A few years ago, my wife changed her Google Voice number. She no longer used it, and like most people, she did not maintain a master inventory showing every online account that still referenced it.

That matters because the modern household has an identity inventory problem.

Most of us have accumulated hundreds of online accounts over many years. As our lives progress, we change phone numbers, change jobs, move homes, replace cards, retire email addresses, and forget about services we rarely use. But those old identifiers do not always disappear from the accounts that once depended on them.

In this case, the retired number remained associated with an old PayPal account that my wife had not logged into for years.

My wife had done many of the things security professionals tell people to do. She uses unique passwords, a password manager, MFA, and passkeys where available. None of those controls helped with an account-recovery path tied to a phone number she no longer controlled.

The first warning arrived quietly: an email saying her PayPal password had been reset.

It went unnoticed and unread in her inbox.

That is not unusual. Personal inboxes are noisy. And anyone who works in security knows the irony: PayPal-themed phishing is so common that legitimate PayPal security messages can resemble the very messages people have been trained not to trust.

About a week later, while catching up on unread emails, my wife noticed the earlier PayPal password-reset notification along with a newer PayPal email for a payment she did not recognize. She asked whether I knew anything about it.

My first thought was phishing.

It was not.

We opened PayPal directly rather than clicking anything in the email. The transaction was real. The account had been compromised.

At that point, the payment stopped being the problem.

It was evidence.

The account was the incident.

The incident responder in me took over

Having led organizations through cybersecurity incidents, I immediately shifted into crisis-response mode. My wife could still get into the account using a legitimate passkey that the attacker had not removed. That was fortunate, because it gave us visibility into the state of the account before speaking with PayPal’s fraud team.

Once inside, I approached it the way I would approach a compromised enterprise identity: establish the timeline, assume persistence, review every trust relationship, remove anything that could allow re-entry, and only then rebuild trusted access.

We found exactly what I would expect an attacker to establish after gaining control:

• A passkey we did not recognize.
• Multiple OneTouch auto-login authorizations that were not hers.
• Multiple unfamiliar Android device sessions.
• Changes to authentication and trusted-access relationships that could allow the attacker to return.

The attacker had done more than change the password. These screenshots show the additional persistence we found inside the account: registered passkeys, OneTouch auto-login authorizations, and approved device sessions. Most of the entries shown were unfamiliar and did not belong to my wife, reinforcing why a password reset alone is not enough to contain an account takeover.

That is the part of account takeover many consumers never see. Once inside, an attacker may establish persistence through trusted devices, sessions, passkeys, or other authentication methods that survive a password reset.

Recovery gives the legitimate owner access again.

Containment removes the adversary.

We reset the password, reviewed authentication methods, removed the unauthorized passkey, cleared unfamiliar sessions and devices, removed OneTouch authorizations we did not recognize, re-established trusted authentication, and reviewed the account for other unauthorized changes.

As far as we could determine, there were no additional unauthorized transactions beyond those already identified. PayPal reversed the unauthorized payment quickly, and there was no financial loss. That part of the response was fast and effective.

But I still did not know how the attacker got in.

And until you know that, you do not know what else you should consider compromised.

How did they get in?

This became the investigative part of the incident.

I called PayPal’s fraud department repeatedly because the answer mattered. If the attacker had compromised my wife’s email account, I needed to respond to that. If they had used an old credit card, I wanted to understand that exposure. If they had answered security questions, that suggested a different problem again.

The first explanation we received was vague and initially pointed us in the wrong direction. A representative referred to my wife’s email address and the forgot-password process, which left open the possibility that the email account itself had been compromised.

So I kept asking.

On a later call, a PayPal fraud representative confirmed the recovery methods used in the actual takeover.

The attacker had initiated PayPal’s “Forgot password” process using my wife’s email address as the account identifier.

Then, according to the representative, the attacker used “Get a Text” as one recovery check and “Get a WhatsApp Text” as the other.

Both went to the same retired number.

I did not rely on that one conversation. We subsequently confirmed the same recovery sequence with additional PayPal fraud representatives, including a supervisor. One representative also confirmed that no email code, credit card number, or security-question response was used. This narrowed the reset path to the SMS and WhatsApp checks tied to the retired number.

That changed the entire understanding of the incident.

At the time of the incident, the PayPal recovery screen we observed presented several options, including SMS, WhatsApp, security questions, and confirmation of a credit card number.

The problem was allowing SMS and WhatsApp associated with the same telephone number to satisfy successive recovery checks.

From a security-design standpoint, those are not independent factors. Two interfaces are not two independent controls when compromising the same underlying asset defeats both.

Based on what PayPal’s representatives told us, that was the path used to reset my wife’s password. Had the recovery process required genuinely independent evidence, this specific takeover path would not have worked.

Large-scale breaches involving companies such as Equifax, Marriott, Meta, Ticketmaster, and Change Healthcare have exposed enormous volumes of personal information, including names, email addresses, phone numbers, physical addresses, dates of birth, payment information, and other identity data.

I do not know how the attacker connected my wife’s retired phone number to her PayPal login, and I do not want to speculate about a specific source or technique. But pieces of our identity now exist across an enormous number of systems, and once that data is exposed, scraped, brokered, or stolen, attackers can potentially connect relationships we may have forgotten ourselves.

What I reported to PayPal and what appears to have changed

Once I understood the recovery path, I told PayPal’s fraud team that I believed the same-number recovery logic represented a serious security weakness and asked that it be escalated.

PayPal never provided me with a written technical explanation of what it changed or when.

But something changed.

When I tested the flow a few days after reporting the issue, I could not reproduce the SMS-then-WhatsApp sequence. After completing SMS verification, WhatsApp tied to that same number was no longer available as the next recovery check. I also tested the behavior using several other accounts available to me and could not reproduce the earlier sequence.

A PayPal fraud representative later told me the recovery concern had been escalated to its technical team and thanked me for bringing it to their attention, noting that it could affect other users as well. She also indicated that the earlier recovery flow was no longer available at that time and said the matter had been taken very seriously.

That deserves credit.

If the control was changed in response to this incident, PayPal moved quickly.

But quick remediation should not obscure the underlying lesson: the recovery design should not have allowed two channels dependent on the same telephone number to function as independent assurance in the first place.

For security and technology leaders, the lesson is simple: adding another verification step does not automatically add security. If the same underlying compromise defeats both, the system may look layered while still depending on a single point of failure.

The bigger problem I still think PayPal needs to solve

The specific recovery weakness we observed appears to have been addressed.

The customer account-takeover support experience is what still concerns me.

During our initial fraud-support calls, the focus was primarily on the unauthorized transaction, the password, and whether my wife could get back into the account.

No representative proactively initiated a comprehensive reset of the account’s trust relationships. We were not immediately guided through every active session, passkey, OneTouch authorization, trusted device, and authentication method. We discovered and removed the broader persistence mechanisms ourselves. It was only after I asked whether PayPal normally helps customers review those areas that a representative offered to walk us through some of the checks.

That may sound like a support-process issue. It is actually a security-control issue.

Imagine the account holder was not married to someone who has spent years dealing with cybersecurity incidents.

Imagine it was your mother.

Your grandfather.

Your aunt or uncle.

The fraudulent payment gets reversed. The password is changed. A fraud representative confirms that the user can log in again.

Would that person know to inspect registered passkeys?

Would they know what OneTouch is?

Would they know to terminate every unfamiliar session and trusted device?

Would they know which MFA methods should be removed and re-enrolled?

Should they have to?

They should not.

A confirmed account takeover should trigger a repeatable containment workflow that returns the account to a known-good state. Active sessions should be terminated, newly added authentication methods and trusted devices reviewed or revoked, recovery information verified, and the legitimate owner helped to rebuild trusted access.

PayPal did an excellent job of quickly reversing the unauthorized charges and recovering the funds, but fixing the transaction is not the same as securing the account.

Security has to work for the least technical legitimate customer while still being difficult for the most capable attacker.

The bigger lesson: your digital identity has an inventory problem

The most important lesson I took from this incident is not actually about PayPal.

It is about how we manage digital identity over time.

Phone numbers, email addresses, postal addresses, payment cards, recovery emails, and authentication methods are no longer merely contact details.

They are identity infrastructure.

Online services use them to decide who we are, how we recover accounts, and sometimes whether we should be allowed to reset credentials.

But most households do not maintain an inventory of that infrastructure.

We should.

I am a strong advocate of password managers, but I think we need to use them for more than passwords. Treat your password manager as a lightweight inventory of the identity information attached to your important accounts.

For financial, medical, government, cloud-storage, primary email, and other sensitive accounts, record at least:

• The registered email address.
• The registered phone number.
• Any recovery email address or phone number.
• The postal address on file when relevant.
• The MFA method in use.
• Any important payment or identity information the service relies upon for recovery.

Then make one behavior routine:

Whenever you change a phone number, retire an email address, move homes, or replace an identity anchor, search the password manager for the old value and update every account that still depends on it.

That simple practice would have identified this old PayPal association before an attacker did.

The security basics still matter

This incident does not mean passwords, MFA, passkeys, or password managers failed. It demonstrates why security has to be managed as a lifecycle rather than a one-time setup.

Use strong authentication, keep recovery information current, review trusted devices and active sessions on sensitive accounts, and treat unexpected password-reset messages as incidents until proven otherwise.

Most importantly, when you retire a phone number or email address, do not assume the risk retires with it.

Security leadership starts at home

Executives and security leaders spend enormous amounts of time talking about identity governance, asset inventories, layered controls, incident response, root-cause analysis, and lessons learned.

Those principles do not stop at the office door.

Our households are small digital enterprises. They contain financial information, health records, identity documents, cloud accounts, personal communications, and the people we care most about.

This incident ended well. PayPal reversed the unauthorized transaction. We contained the account. The specific recovery sequence involved in the takeover appears to have been changed after I raised it. Those are meaningful positives.

But the incident should never have been possible through the recovery path PayPal’s representatives described to us.

And a customer who reports a confirmed takeover should not need cybersecurity expertise to make sure the attacker has truly been removed.

That is where I believe PayPal, and every company responsible for sensitive consumer identities, should keep improving.

If you do one thing after reading this, open your password manager today and search for every old phone number and email address you can remember.

The account you forgot about may be the one an attacker finds first.

Joshua Bellendir is a technology executive and advisor with global CIO and cybersecurity leadership experience across retail, technology, and consumer businesses.

The post Two Recovery Checks. One Retired Phone Number. A PayPal Account Takeover. appeared first on Joshua Bellendir.

Click here to see the device in action and read MishiPay’s LinkedIn post for a behind-the-scenes look at the pilot.

Read the full WHSmith Case Study here.

#RetailTech #POS #DigitalTransformation #Teamwork #F1 #AirportRetail #NewLaunch

The post From Concept to Checkout in 7 Weeks: How MishiPay Powered a Next-Gen POS Pilot in Airport Retail appeared first on Joshua Bellendir.

These hacking groups are openly recruiting employees and paying for insider access. Their target list spans telecom, retail, tech, cloud, gaming, and BPO companies. The sophistication of their social engineering and the speed at which they exploit access continues to increase.

For many companies, the biggest risk is not just external attackers. It is the combination of human behavior, access sprawl, weak identity governance, and the absence of strong cultural reinforcement around security.

This raises an important question for all of us in the industry:

What steps are you taking inside your organization to reduce the risk of insider threats?

Are you doubling down on identity governance, monitoring privileged access, improving off-boarding processes, building stronger security awareness programs, or investing in tools that help detect unusual behavior across your environment?

Curious to hear how others are approaching this challenge and what is working well in your companies.

You can read the full article here: https://www.bleepingcomputer.com/news/security/crowdstrike-catches-insider-feeding-information-to-hackers/

The post The Growing Insider Threat: Why Trusted Access Is Now One of Cybersecurity’s Biggest Risks appeared first on Joshua Bellendir.

What’s your take: should unmanaged devices ever touch corporate systems?

Read the full story on CSO Online:

The post One Unprotected Laptop Is All It Takes appeared first on Joshua Bellendir.

Read more about them here

The post Celebrating Innovation and Leadership at the 2025 Las Vegas Top Tech Awards appeared first on Joshua Bellendir.

The post Why Every IT Leader Should Read “Fostering Innovation” by Andrew Laudato appeared first on Joshua Bellendir.

1. From IT Projects to Business Transformation

The article highlights an important shift. We are not simply delivering IT projects. We are leading business transformation efforts that rely on technology to succeed. In my work at WHSmith, SoftBank Robotics, and Fast Retailing (Uniqlo), this distinction has been clear. Success is not measured by implementing a system. It is measured by how the business changes, how operations improve, and how growth accelerates.

2. Value Creation and Revenue Focus

CIOs are increasingly being evaluated on their ability to create value. The article notes that many organizations are now directing investment toward monetizing data and developing new digital revenue streams. For me, this shift reinforces the need to align all technology programs with measurable business outcomes, whether they involve new customer engagement channels, loyalty initiatives, or improved retail experiences.

3. Scaling AI for Real Impact

Impactful AI continues to rise on priority lists. The article suggests that the age of pilots is fading and CIOs are now concentrating on enterprise level adoption, governed data pipelines, and models tailored to specific use cases. In my experience, the foundation matters most. Data, pipelines, governance, and model discipline must come before the question of what can be automated or predicted next. Trust and value both depend on that groundwork.

4. AI Security and Governance

The potential of AI comes with new risks. Many CIOs are treating AI as a new security frontier that covers model transparency, vendor oversight, and adversarial threats. From my perspective, governance and security need to be part of the design from the beginning. They cannot be bolted on after momentum builds.

5. Enterprise Security

Security remains a constant priority. Even as innovation accelerates, strengthening the overall security posture continues to sit at the top of CIO agendas. This reinforces something I have believed throughout my career. No matter how forward leaning the roadmap is, the foundation must be strong. You cannot build advanced capabilities without protecting the core first.

6. Customer Experience (CX)

Improving customer experience remains a defining project area, and it frequently sits at the intersection of digital, operations, and culture. The article cites examples such as automated quoting, AI enabled support, and self service capabilities. In retail and F&B environments, I have seen that the technology used by store teams and customers is only as strong as the systems behind it. Real time data, analytics, integration, and reliable infrastructure matter just as much as the features that appear on a screen.

7. The IT Foundation

While emerging technologies receive much of the attention, the foundational elements remain essential. ERP modernization, cloud optimization, integration layers, and API strategies are still at the center of effective transformation. In my roles, ensuring that the foundation is stable and current has always been a priority. Innovation only scales when the core environment can support it.

8. IT Modernization

For many organizations, modernization is both the engine of change and the enabler. It often involves retiring legacy systems, introducing modern platforms, moving toward cloud first strategies, and enabling better scalability. The article includes a quote that captures this direction well:

“Retiring old legacy systems that are slowing us down, introducing modern solutions… everything we do will support our data initiatives and will give us the data we want for AI and allow us to scale and the business to grow.”

This reflects much of what I have focused on in large scale retail and global operations environments.

9. Reimagining IT for the Future

One of the most important shifts is a forward looking mindset. The focus is no longer on what the company needs today but on what it will need two, three, or five years from now. The article references my work in future proofing IT environments and improving scalability by implementing solutions that are efficient, flexible, and designed to support long term growth. This is central to the CIO role. We are not only supporting current operations. We are shaping the technology landscape that the business will rely on in the future.

My Reflections for IT Leaders

• Be strategic first. Projects should be framed around business impact, not technical activity.
• Align every initiative with a measurable outcome such as revenue growth, margin improvement, or customer experience.
• Build the foundation early. Innovation only succeeds when data, security, governance, and core systems are strong.
• Look ahead. Modular architectures, scalable operating models, and global flexibility are no longer optional for competitive organizations.
• Lead with confidence. CIOs are not simply maintaining the business. They are helping to reinvent it.

You can read the full article here:
https://www.cio.com/article/3992816/9-projects-top-of-mind-for-it-leaders-today.html

Note: I was interviewed for the original May 2025 version of this CIO.com article. The article has since been refreshed for the current year. The link above now points to the original 2025 article preserved by the Internet Archive.

The post Quoted in CIO.com | 9 Projects Top of Mind for IT Leaders Today appeared first on Joshua Bellendir.

The post Agentic AI + Ransomware = The Next Cyber Threat Frontier appeared first on Joshua Bellendir.

While speaking with the reporter during her research for the article, I was struck by how consistently these priorities surface across industries. I was also quoted in the final piece, adding my perspective on how IT can better align with the business, but the broader insights from leaders across sectors make it well worth the read.

If you’re thinking about how the CIO role is evolving, here are a few ideas the article brings forward:

1. CEOs want IT to lead, not follow
Technology leaders are expected to directly influence revenue, customer experience, and operational excellence — not just support them.

2. AI needs to deliver real value
The shift from experimentation to practical, measurable outcomes is accelerating. CEOs want AI initiatives to solve real problems, not create new ones.

3. Balancing transformation and stability
Modernization efforts must coexist with the realities of legacy environments and day-to-day operational demands. It’s a tightrope every CIO knows well.

4. Security and resilience remain foundational
Economic and geopolitical pressures are pushing cybersecurity, regulatory readiness, and risk management further into the strategic spotlight.

These points mirror what I see in my own work and in discussions with other technology leaders. If you’re interested in how the CIO role is changing — and what’s being asked of us at the executive table — this article provides a clear snapshot of where things are heading.

You can read the full piece here:
https://www.cio.com/article/3982258/ceos-top-priorities-for-it-leaders-today.html

Note: I was interviewed for the original May 2025 version of this CIO.com article. The article has since been refreshed for the current year. The link above now points to the original 2025 article preserved by the Internet Archive.

The post Quoted in CIO.com | What CEOs Expect from Today’s IT Leaders appeared first on Joshua Bellendir.

The post Join Your Peers in Celebrating Visionary Tech Leaders in Las Vegas appeared first on Joshua Bellendir.