j0ekerr: Just wanted to throw it out here, it might be old news to most users but if even one person is given warning and manages to be on guard it'll be worth it.
For some time I had been receiving regular emails in my account from paypal. These were a bit strange since they offered me discounts and special offers on products and services which don't really fit in with paypal's business model. But the emails were so exquisitely crafted, with every single detail perfectly reproduced and even addressing me by my real name which only paypal should know, that they seemed 100% genuine. I dismissed them as being a sort of added services, kind of like a newsletter from paypal and didn't give them a second thought.
The other day however, one of the emails prompted me to check my account activity, not my balance, not my credit or bank details, just my activity. I felt a bit confused, but proceeded to check it out nevertheless. Out of good practice, I opened a new tab and typed the paypal url manually instead of
clicking on the provided link in the email. That proved to be my salvation, since at that point I had no reason to think that the email wasn't actually genuine.
After checking my paypal account and noticing that nothing was out of the ordinary I went back to the email and double checked it again, why would they want me to check my activity? That's when I noticed it, and I slammed my face on my desk at my idiocy. The sender's address was
E.paypal.com that one letter was what made me think it was a phishing scam. Some research thanks to google later, I confirmed it. The emails as I said are exquisite, they are finely tailored and reproduce to the letter the typography and format of a paypal's email. The bit that scared me however, was that they were addressed to me personally using my real name and citing my account details. The
provided link to paypal was the scam's trap, since it referred to a page, virtually identical to the paypal.one. Just with a still image instead of an animated background and with a hodgepodge of text in the url bar. It provided your correct email address/username for you and prompted you to type your password, at which point they gained access to your account.
Annoying as well is the impression that paypal seems to be doing nothing. Forum users over the net are complaining at the far too high quality of the forgeries (not your usual, prince of Nigeria letter), the fact that the phishing emails included personal account information (like my real name, how did they get that?), and paypal's apparently tight lipped policy about it.
In short, beware any and all emails involving services that deal with real money, even if they do seem 100% legitimate. And
never EVER blindly click on any links in your emails even from senders you think are genuine. My slightly paranoid practice of always typing urls manually when dealing with password protected sites proved out to be fully justified in the end.
I apologize if this has been addressed at another thread, but a quick search didn't yield any results.
The majority of email travels over the Internet unencrypted and as such is susceptible to being sniffed off the wire by people who have the proper access to one of the machines that it passes through or past on the wire. If someone knows your name and email from any source whatsoever, they can hand craft rather flawless looking emails appearing to come from Paypal, Facebook, any bank, etc. using example real emails from those sites/services as a template fo their forgery. The "From" address in emails is very trivial to forge and can never be trusted on any email. (Do a web search for how to forge the from address on email to find a tutorial on how easy it is for example.)
Even if someone is using Gmail or similar services and connecting to them over https always, that just protects the connection between your own computer and gmail, but not how the email arrived at Google in the first place. The only safe assumption to make is that every email we send or received is completely visible to anyone who wants to see it bad enough (criminals, government spy agencies, whoever). There is no real way to prevent it so one must assume "the gun is loaded" so to speak.
The bad guys don't even need to know whether or not you actually have a Paypal account, all they need is your email address and name and the names and addresses of 10 million other people, and they send out the fraudulent mails to all 10million people and know that some fraction of those people have used paypal before and probably have a paypal account and that some of those will be using the same email also. That's enough to snag a few fish when they reel in.
Another way is they steal identity information from infecting people's PCs with malware etc. also, and steal emaill addresses from the infected PC's address books etc.
Whenever you receive emails from your bank, paypal or some other critical service - always be suspicious. Turn on full email headers, completely ignore the "From" line as it is trivially forged, and scan through the Received headers and other headers present to try to determine where the email actually originated from for real. Most of the time the fraudulent nature of an email scam is revealed via one or more of the headers on the email message. You can also use the DKIM header as a way to try to validate the message (search the web for DKIM).
Unfortunately, email is and most likely always will be an insecure communication mechanism, and things that attempt to make it more secure like GPG/PGP etc. require technical acumen that the average person does not possess to utilize properly so ultimately one must always be cautious when it comes to trusting email and where it is truly coming from.
I just purchased some stuff from Amazon for the first time in ages about a month ago. Within a week I started getting inundated with all kinds of Amazon scams, false advertising etc. Now I receive real amazon mailings and ads too, but I got tonnes of obviously fake ones as well. Some are addressed to me directly. How do they know my name and email? I dunno. Chances are they have some way of observing the fact that I made an Amazon purchase recently, possibly by sniffing the legitimate emails coming from amazon to me, or possibly from some other criminal method. Could just be a coincidence too, but this is the second or third time I purchased something online somewhere and had fraudulent emails appear to come from the same retailer afterwards which were just phishing mails etc.
One can never be too careful! :)
