elf89

Hi folks,

I got a really nefarious e-mail this weekend I thought I'd share with the board. It was supposedly from Paypal saying they had randomly flagged my account for a security update.

The link was an IP address, not <a href="https://www.paypal.com," target="_blank">https://www.paypal.com,</a> but it was a very good mockup of a Paypal page. Of course it asked for all private info like address, phone number, credit card info, paypal password. Really scary stuff.

I reported it to Paypal, but wanted to make sure all you Paypal users were aware of some nasty people out there trying to steal your stuff.

Manning

Nice of you to mention it. A caller on the Screen Savers brought it up the other day as well. I got the same e-mail about three weeks ago and found it kind of odd that a legitimate company like Paypal would want you to fill out and return a form with personal financial data via e-mail

If you view the code for the e-mail you can see the images are all being pulled from the Paypal site, but then you notice that the actual form is being generated from and the reply would be sent to an entirely different domain.

Clever little ****heads aren't they.

993Maineiac

Very clever using https which is, of course, the secure band. Thanks for the heads up.

Peckster

What was the name of the sender? Return email address?

Manning

You know, I can't tell you for surebecause I deleted the e-mail last week. I think the display name was spoofed to look like customerservice@paypal.com or something like that. I didn't actually bother to view source for it though to see what the actual authenticated return address was.

Manning

Oh yeah, not only do I have over 1000 posts now and need to get a life, but check this out: The guy who outed this scam on the Screen Savers pointed out that if you were actually stupid enough to fill out the form and send it back your information was now available to the public on some web site someplace. Kind of made it seem like the scam was to teach dumb people a lesson or something.

SidViscous

Reading Mitnicks book "The art of deception" now. Very interesting if it is a tough read. Just finished the part with an older similar scam, but with the ebay ending in the tripod.com domain.

Basically as you read it you realize you can't trust anyone that you cannot verufy, and even that just reduces the amount of times you'll get screwed. Like when a worm e-mials you from a friend or co workers account.

Worth reading if for no other reason but you'll realize you were the target of a social engineer in the past. When I used to work for Segway I got a few calls from people asking to be transfered to Dean's (owner) office. I said not only can't I but I wouldn't. If you want to leave your name and ..... "No that's okay I'll just call so and so"

After reading his book you see that is standard attack.

elf89

The return e-mail address was "service@paypal.com" with a suspicious disclaimer at the bottom "Don't reply to this e-mail address because we can't process your reply."

Another scam we got hit with at work was someone who called the receptionist claiming to be from the phone company checking are lines. Asked to be transferred to "9-0" to complete the test. Well, 9 gets you out of the system and 0 gets you to an operator where you can make an operator assisted call on our bill. We caught that one right away, but not before someone made a $900 call to Yemen. We didn't have to pay it because we reported the fraud right away (even before we got our bill), but what a pain.

TMH

Bottom line is NEVER, NEVER give out personal information in response to an e-mail. Same thing happened with an eBay scam a little while back (and probably continuing). Got an e-mail from "eBay" specifying that my account was on hold because "someone had hijacked it and was not completing auctions won in my name." I separately went into the eBay site and changed my password, just in case. Then I forwarded the e-mail to the fraud division at eBay, and they confirmed it was a scam.

Bears repeating: NEVER, NEVER give out personal information in response to an e-mail, especially an unsolicited one. If you ever have concerns, close the e-mail, and go directly to the "requestor's" site using your browser. Only then can you be guaranteed that you are not being scammed.

One last item: NEVER, NEVER give out your credit card number (or any other personal information) in response to an unsolicited telephone call. If you even think that the call is legit (like from your bank or the CC company), find out who they "represent" and end the call. Then call back using the telephone number on the back of your credit card, and request to be transferred to the appropriate individual or department. Once again, only then can you be assured of who you are speaking with.

Good luck out there - it is a dangerous world with identity fraud rampant.

Tom

Legoland951

I got an easy fix. Execute the people who get caught doing this kind of crap like the guys at Enron and Tyco and I guarantee after a couple executions, this will all stop.

Tony

I got the same email from "PayPal" as well last week. Im like.."sha..right"
<img border="0" alt="[cheers]" title="" src="graemlins/beerchug.gif" />