Posted July 04, 2014
high rated
Just wanted to throw it out here, it might be old news to most users but if even one person is given warning and manages to be on guard it'll be worth it.
For some time I had been receiving regular emails in my account from paypal. These were a bit strange since they offered me discounts and special offers on products and services which don't really fit in with paypal's business model. But the emails were so exquisitely crafted, with every single detail perfectly reproduced and even addressing me by my real name which only paypal should know, that they seemed 100% genuine. I dismissed them as being a sort of added services, kind of like a newsletter from paypal and didn't give them a second thought.
The other day however, one of the emails prompted me to check my account activity, not my balance, not my credit or bank details, just my activity. I felt a bit confused, but proceeded to check it out nevertheless. Out of good practice, I opened a new tab and typed the paypal url manually instead of clicking on the provided link in the email. That proved to be my salvation, since at that point I had no reason to think that the email wasn't actually genuine.
After checking my paypal account and noticing that nothing was out of the ordinary I went back to the email and double checked it again, why would they want me to check my activity? That's when I noticed it, and I slammed my face on my desk at my idiocy. The sender's address was E.paypal.com that one letter was what made me think it was a phishing scam. Some research thanks to google later, I confirmed it. The emails as I said are exquisite, they are finely tailored and reproduce to the letter the typography and format of a paypal's email. The bit that scared me however, was that they were addressed to me personally using my real name and citing my account details. The provided link to paypal was the scam's trap, since it referred to a page, virtually identical to the paypal.one. Just with a still image instead of an animated background and with a hodgepodge of text in the url bar. It provided your correct email address/username for you and prompted you to type your password, at which point they gained access to your account.
Annoying as well is the impression that paypal seems to be doing nothing. Forum users over the net are complaining at the far too high quality of the forgeries (not your usual, prince of Nigeria letter), the fact that the phishing emails included personal account information (like my real name, how did they get that?), and paypal's apparently tight lipped policy about it.
In short, beware any and all emails involving services that deal with real money, even if they do seem 100% legitimate. And never EVER blindly click on any links in your emails even from senders you think are genuine. My slightly paranoid practice of always typing urls manually when dealing with password protected sites proved out to be fully justified in the end.
I apologize if this has been addressed at another thread, but a quick search didn't yield any results.
For some time I had been receiving regular emails in my account from paypal. These were a bit strange since they offered me discounts and special offers on products and services which don't really fit in with paypal's business model. But the emails were so exquisitely crafted, with every single detail perfectly reproduced and even addressing me by my real name which only paypal should know, that they seemed 100% genuine. I dismissed them as being a sort of added services, kind of like a newsletter from paypal and didn't give them a second thought.
The other day however, one of the emails prompted me to check my account activity, not my balance, not my credit or bank details, just my activity. I felt a bit confused, but proceeded to check it out nevertheless. Out of good practice, I opened a new tab and typed the paypal url manually instead of clicking on the provided link in the email. That proved to be my salvation, since at that point I had no reason to think that the email wasn't actually genuine.
After checking my paypal account and noticing that nothing was out of the ordinary I went back to the email and double checked it again, why would they want me to check my activity? That's when I noticed it, and I slammed my face on my desk at my idiocy. The sender's address was E.paypal.com that one letter was what made me think it was a phishing scam. Some research thanks to google later, I confirmed it. The emails as I said are exquisite, they are finely tailored and reproduce to the letter the typography and format of a paypal's email. The bit that scared me however, was that they were addressed to me personally using my real name and citing my account details. The provided link to paypal was the scam's trap, since it referred to a page, virtually identical to the paypal.one. Just with a still image instead of an animated background and with a hodgepodge of text in the url bar. It provided your correct email address/username for you and prompted you to type your password, at which point they gained access to your account.
Annoying as well is the impression that paypal seems to be doing nothing. Forum users over the net are complaining at the far too high quality of the forgeries (not your usual, prince of Nigeria letter), the fact that the phishing emails included personal account information (like my real name, how did they get that?), and paypal's apparently tight lipped policy about it.
In short, beware any and all emails involving services that deal with real money, even if they do seem 100% legitimate. And never EVER blindly click on any links in your emails even from senders you think are genuine. My slightly paranoid practice of always typing urls manually when dealing with password protected sites proved out to be fully justified in the end.
I apologize if this has been addressed at another thread, but a quick search didn't yield any results.
Post edited July 04, 2014 by j0ekerr
