WARNING: PayPal Fraud Emails

[NamePopper.com]

WARNING

Someone is sending emails to (apparently) random addresses with the following message......

- - - - - - - -
As part of our continuing commitment to protect your account and to reduce the instance of fraud on our website, we are undertaking a period review of our member accounts. You are requested to visit our site by following the link given below :

(I have removed the link for obvious reasons)

Please fill in the required information. This is required for us to continue to offer you a safe and risk free environment to send and receive money, and maintain the PayPal Experience.
- - - - - - - -

These emails appear to come from service@paypal.com - and they contain the entire PayPal website homepage including all the links and graphics. However - the link given in the message body (above) is NOT a real PayPal link.

This started last night when I received several of these emails at addresses that are not associated with my PayPal account - and have never even been used before. That immediately sent up a red flag in my mind. So this morning my brother (who's account I share) contacted PayPal and verified that in fact this is an attempt to get people to log in to a fake site - and enter their name & password.

All the other links and graphics in the email are the real ones from PayPal (I guess to give it credibility) but the link where they ask you to visit and enter your information is NOT.

I went ahead and clicked the link this morning to see what happened - and it brought up a error 404 page - so apparently the crooks have already moved on to a different one - but this is almost certain to happen again.

For the record - when you mouse-over the link in the email - you will see that the link that shows up in your status bar (bottom of your browser) does not exactly match the link printed in the email - and is also an http address - whereas the link printed shows a https address (secure). These guys are tricky.

So please everyone - do NOT go to ANY links that you receive from a PayPal email and enter your account information. There is no telling how many people got an email this time - but even though they appear to have moved on - it's almost certain there will be another attempt.

Again - these emails look perfectly legitimate - and are complete with the entire PayPal homepage and working links. Only the link where they ask you go is false. If not for receiving them at addresses that were not associated with our account - I might have even been fooled myself. Pretty scary stuff.

[Rocket2Uranus]

devious!

[NameTower]

thanks popper

[hellstrom]

Was the URL of the fake page a misspell/typo of "paypal.com"?

[GT Web]

thanks Popper, I will look out for it

[NamePopper.com]

Originally posted by hellstrom
Was the URL of the fake page a misspell/typo of "paypal.com"?

No it wasn't. Since the page is dead now - it's ok to post it I guess.

The email showed this link....

https://www.paypal.com/cgi-bin/webscr?cmd=verification

But when you clicked it - you were actually brought here....

http://www.paypal.com@207.44.196.35/...=verification/

Notice the "@207.44.196.35" after the paypal.com part - and also notice they made the link in the email appear to be a https (secure) address when it was actually an http (non secure) address when you clicked it.

By the way - if you cut and paste the link from the email into your browser - or click the first link above - (instead of clicking it in the message) - it will take you to a PayPal page that says you have requested and outdated version of PayPal etc.

They (PayPal) said there is a lot of this going on.

I'm going to take a screenshot of the message and upload it. Gimme just a minute.

[NamePopper.com]

Well - the forum system will only allow a 500x500 image to be attached - so it won't accept my screenshot of the original email. Hmmmm.....

Anyway - I received the short version of the message apparently - because I've discovered there are some people at other forums saying they also got fake emails - but they were much longer - and included more than just the one paragraph message we received.

[Bob]

I got one of these a year or two ago, but not recently. I also get them periodically trying to get me to verify my Yahoo! details. . . .

Needless to say, I trash them.

-Bob

[NamePopper.com]

Hey Bob..... your new signature is cracking me up.

[bidawinner]

what a bunch dickheads,.. Thanks for the heads-up popper !

[insomnia]

Hmm, if you go to 207.44.196.35, you see the empty index, and this:
Apache/1.3.27 server at server3.neosurge.com Port 80

neosurge.com is where they were hosted?

[Bob]

Originally posted by NamePopper.com
Hey Bob..... your new signature is cracking me up.

I have been accused of it on occasion.

[Steen]

i get these daily.

When i first started getting them, I was like OMG! this is seriosu, dum people could b suckered into this.

I told ebay, and that was that.

A few weeks later and they start to pile up, i ogt to ebay, thier response:

"Those are jsut spam"

LoL. I thought it woudl be ALOT more important to them. maybe i got a bad CSR...

[QuantumBeam]

Good advice......thanks.

[OFS]

Good call.

[Donna Mahony]

I called PayPal about these and one important tip they gave me is that these people are also able to add paypal to your blocked senders list in outlook so that if they successfully get your info you will not get the notification emails. You can check this is tools>message rules>blocked senders list to be sure it hasn't happened to you.