Yesterday, TechCrunch reported on a scenario that seems to be growing in seriousness. iTunes account holders that have their Paypal accounts linked as their method of payment are finding their Paypal account balances and in some cases even checking accounts emptied out. So if you use Paypal as a payment method in iTunes, you should not do that if you want to keep your money.

The issue apparently arose because scammers found a way to trick iTunes into authorizing Paypal purchases without the users knowledge. TechCrunch got an initial tip from a man who experienced the problem, but was able to catch it before Paypal sent out the payments.

At least one group of scammers has found a way to charge thousands of dollars to iTunes accounts through PayPal. One targeted customer told us, “My account was charged over $4700. I called security at PayPal and was told a large number of iTunes store accounts were compromised.” His email was filled with nearly 50 receipts from PayPall for $99.99 each. (Update: they were for “CastleCraft, Dragon Crystals (10000 Pack), Seller: Freeverse, Inc”). He was able to catch it before his bank disbursed funds to PayPal.

Whoever is behind the attacks managed to make off with much more cash from PayPal users that weren’t able to catch the transactions in time to stop them. These users are now mired in the tedious paperwork involved in getting Paypal to reverse a transaction and return the money to the defrauded party. I’ve had some experience doing this and I can tell you it’s not fun and very time consuming. One of the victims, Joey Bruce tweeted the following:

A search of Facebook public status updates revealed that the problem isn’t so isolated, one update read:

Everybody watch your itunes account closely. I just got hacked for almost $1000.00 worth of software, videos and music. Hopefully paypal will refund it all. . . . This happened within the last few hours. Once transaction after another.

I’m sure the issue is an authentication glitch of some sort with the iTunes subscription service and should be fixed soon, but that doesn’t change the fact that you should probably un-link your accounts for now to be safe.

[TechCrunch]