BEWARE - Fraudulent email to get PayPal, CC & Bank Info

[rkr1958]

BEWARE ... I DID NOT fall for it and I know all the users of this site are too sophisicated to fall for it but I received a fraudulent email purporting to be from PayPal. I thought I'd bring it to the attention of the users at this site just in case ... Below is an excerpt from the fraudulent email I received,

Subject:Confirm Your Information!]Reminder: Confirm Your Information

Dear Customer,

This is a reminder that we need you to confirm your information. This is a recent measure to protect our customers.

How To Confirm Your Information


PayPal always keep in touch with it's customers. Please use instructions below.

Step 1: Follow this <link> located at PayPal site to fill needed information.

If you follow the <link> (which I've removed) given in step 1 it takes you to an IP address (not PayPal) that asks you to enter your personal info, credit card info, bank info and social security number.

I reported the Fraudulent email to PayPal and the following is taken from their email response,

spoof@paypal.com[/email] Subject: RE: FW: Confirm Your Information!]Thank you for bringing this suspicious email to our attention. We can
confirm that the email you received; was not sent to you by PayPal. The
website linked to this email is not a registered URL authorized or used by
PayPal. We are currently investigating this incident fully. Please do not
enter any personal or financial information into this website.

If you have surrendered any personal or financial information to this
fraudulent website, you should immediately log into your PayPal Account and
change your password and secret question and answer information. Any
compromised financial information should be reported to the appropriate
parties.

[sterno]

I've gotten a few messages of the same type claiming to be from earthlink. Mostly saying something about how the credit card on file couldn't be verified or something similar and that you need to click the link to give them your information again.

[rkr1958]

What's really unsettling to me is that the site is very good. You can't tell it from the real PayPal site except if you look closely at the URL. Also, anyone who would fall prey to it not only gives up their Bank and Credit Card Info but their Social Security Number. I would think that anyone who fell prey to this would be subject to Idenity Theft ...

The Fraudulent site is so good it makes me wonder if Organized Crime is involved?

[redwudz]

Paypal has sent me notices that they are having problems with this sort of email. I've seen this with other pay sites also. One the emails had frequent misspellings in the text that made me suspicious. I had to cancel my credit card recently from fraudulant charges. It pays to be suspicious and go back to the original paysite, and not follow any directions from bogus sites. If you use credit cards, check the statements often. With credit cards, you can usually deny the charge. Paypal is a major target of fraud because they are world wide. No legitimate pay site will ask for your card number or other personal information to be sent by email, it is very insecure. Also watch for bogus web pages that mimic the real ones. There are sites which would use a name like 'Paypals' to make you think they are a valid site. If in doubt, hesitate and research.

[sterno]

I don't know about yours, but the one message that I actually checked out and reported used a form that was just a page copied off the Earthlink site with the form changed to point to some other machine.

[rkr1958]

Paypal has sent me notices that they are having problems with this sort of email. I've seen this with other pay sites also. One the emails had frequent misspellings in the text that made me suspicious. I had to cancel my credit card recently from fraudulant charges. It pays to be suspicious and go back to the original paysite, and not follow any directions from bogus sites. If you use credit cards, check the statements often. With credit cards, you can usually deny the charge. Paypal is a major target of fraud because they are world wide. No legitimate pay site will ask for your card number or other personal information to be sent by email, it is very insecure. Also watch for bogus web pages that mimic the real ones. There are sites which would use a name like 'Paypals' to make you think they are a valid site. If in doubt, hesitate and research.

The site that the link took you to was good, very good. It even included the PayPay(r) trademark. It was professional. Only two things gave it away to me. The first was that they were asking you to enter personal, bank and CC info without first logging into your existing account. The second was the URL. I could see how may online shopping "novices" would be / could be dupped by this site. The site was professionally done. Again, makes me wonder if Organized Crime of some type is involved.

[ChrisX]

Don't respond to any phishing and they can be so sophisticated to make appear to be from your bank, your PayPal, your eBay, and any of your online services.

I know they don't ask me for details by email, so I don't repond.

Only a fool would fall for it, the scam. So, don’t ever give out your private info to them. Never on your email.

[mob]

one would have to be a fool to fall for these scams. all you have to do is look at the url and you see its not really a paypal site.

[Hardcoreruss]

The address it came from looks kosher though even though it is not, how would they go about doing that ?, service@paypal.com ?

[sterno]

Forging a return address is trivially simple because of how e-mail works. Servers do not (and can not) verify the return address, any more than the post office could verify the return address on every envelope that goes through the mail.

When people use HTML mail readers they'll need an actual conscious thought to see the URI. It seems like most of the people I see using HTML mail are not exactly the best and brightest, so I'm sure some people fall for these scams. Just like some people fall for the $21M Nigeria scams, the international lottery scams, etc.

[housepig]

The address it came from looks kosher though even though it is not, how would they go about doing that ?, service@paypal.com ?

take a look at the full header from the mail, not just the brief header that most mail services show you by default.

it should be a long string of "mailxxxx recieved from server xxxx" that will show you the whole path of the mail from the originator to you... if you start looking in there and don't see servers that end in ebay.com or paypal.com, etc., you've been spoofed.

[ChrisX]

The international lottery scams

I received a couple in the mail yesterday at the post office suggesting big wins and a fee are payable to get the checks.

I've been getting these for years now and I now ignore them and they get thrown in the bin.

I did get stung three years ago and I no longer write a check to the scams. They cheat and only after my check, not a check to me.

If they say I won a prize, then they should have posted a check with the letter notification.

In some cases, Australia Post at customs does stop some the scams from coming through.

There was a recent report of a Spanish lottery fraud, El Gordo being stopped from getting to the addresses. This isn’t the real one and as a scam. I received one a few months ago and I ignored this one.

Check out: http://vsbabu.org/mt/archives/2003/09/13/el_gordo_winner.html


In some cases, they ask for your bank details for a deposit of your winning. This is as scam and I would never give details to them.

Just beware, a telemarketer on the telephone asking for your details spells trouble. Just say no and I am not interested in your competition.

Otherwise, you may get all sorts of junk mail in your letter box including the international lottery scams.

[ChrisX]

"New MiMail mixes tricks for PayPal scam" this is a heading from ZDNet.

Check out: http://www.zdnet.com.au/news/security/0,2000061744,39115727,00.htm

[pacmania_2001]

If you are stupid enough to fall for half these scams (the really obvious ones) you deserve to be scammed.