Security News PayPal Users, Beware of Phishing Campaign Trying to Steal Your Identity

[Exterminator]

When you’re a PayPal user, you’re somewhat used to being extra careful when you receive emails about your balance and whatnot since there have been countless phishing campaigns over the years. Well, now there’s a new one.

This new phishing campaign targeting PayPal users makes use of fake pages that are remarkably well done, which makes them hard to distinguish from real ones. According to ESET researchers, this attack uses a highly convincing bait, takes you through fake websites that look real and pretty much tricks you into revealing your login credentials and other personal information.

The emails people receive include logos, wording that looks just about right at first glance. When you look deeper into the problem, you might notice grammar and syntax errors suggesting the author isn’t a native English speaker.

So how this work?
Well, these emails tell you that PayPal needs help resolving an issue with your account and that there are some temporary limitations to the account until the problem is solved. This should make you want to hurry up and fix whatever is causing trouble. The email conveniently includes a “log in” button at the bottom of the page. Click it, and you’ll be taken anywhere but the official page of PayPal.

Sure, the page might look real, but the URL is anything but, indicating that it’s all a hoax. Once there you will have to enter your login credentials which will effectively go out to the scammers. You are then presented with data to back up the “limited account” lies presented in the email.

The next page you’re taken to makes this scam even more dangerous because this is where they try to steal your identity. You have to provide your address, phone number, mother’s maiden name, social security number, date of birth and more. What’s more is that you won’t be able to interact with PayPal until all this data has been provided, so you’re fooled into a sense of urgency to get to the end of the line.

Avoid traps
Such campaigns are quite well crafted, but you should remember that it’s all fake and that you should never ever try to fix an account problem on any service by tapping the buttons you are provided in these emails. Some may be real, but most are probably not. Just open your own PayPal (in this case) page in a different tab, log in there and see if there are any issues to fix in the first place.

For the record, when it comes to PayPal any request for more information to remove limitations for your account come via email and do not contain any link or button as those we’ve seen in this scam. The email will address you by full name, and they’ll contain the data that you need to provide and a full explanation as to why this happens.

Furthermore, when logging into PayPal, you’ll have to upload copies of utility bills, bank statements and so on, not to input your information by hand. Either way, you should make sure, as previously stated, to open your own account page and not to click on links sent in emails or to open attachments in unsolicited emails. Even if you, for some reason, tap on those links, make sure the URL in the address bar is what it’s supposed to be. Most browsers nowadays will flag suspicious pages, but you should look nonetheless in case it has missed detection.

 

[Paul123]

Ive had so many phishing mails about Paypal over the years, that in the end I closed my account. It just wasn't worth the hassle, and it got to the point where I couldn't tell the real from the phish. So far Ive survived perfectly well without it.

In regard to grammar mistakes, I remember hearing a theory that these are in fact on purpose, that they help filter out the gullible, from the astute allowing the scammers to determine which people to target. Once you are on a scammers list you pretty much inundated. When we moved to our old house BT gave us a number that obviously had belonged to someone who'd been scammed, we started receiving loads of calls for the person from things such as Microsoft support (you have a virus), youve won a ...., share buying scams etc.

 

[aragornnnn]

I see lots and lots of these Paypal phishing links being tweeted by researchers on twitter.
Sometimes more then 30 a day which is crazy

 

[Dave Russo]

I had a false Paypal site come up in my spam folder asking for my password ,First time I noticed it,Funny because I have password saved on my computer ,really does look authentic, Thanks'"Exterminator"
for the heads up

 

[LoLs]

always use different mail address (not paypal) when register to sites/forum. Only use your mail (paypal) when register to online shop that you intended to purchased, eq. game store, etc. This way you will never get any phishing mail sent to your paypal mail. And if you received mail claimed from paypal or else, it's better to open directly via web browser to check without click any link from your mail address.

Usually the fake paypal mail will not mention your name on it..
But i once getting phishing mail sent to me and it's has my 1st and mid name.., Was sent to mail address that i don't used anymore,. Turn out i figured it's related to my brother yahoo mail, as me is one of his contact list. So i'm guessing the phisher's had my bro mail address and then use the contact list to start his phishing campaign. I block the mail and tha'ts it

so story short.. yahoo mail sux