Another scam warning - recent PayPal phishing
- Posted May 13th, 2008 at 3:54 pm by Ryan
- Categories: Anti-Spam, General, Security, Tips & Tutorials
I received a lot of positive responses (comments and email) after last week’s warning about bogus Yahoo! Lottery scams, so I thought I’d keep with that theme and offer up some more tips.
Hopefully just about everyone knows that when someone sends an “URGENT” message “from the desk of…” some guy insisting that you just lucked into a fortune, your “too good to be true” alarms should sound off.
But a well crafted phishing email can be a little harder to spot without looking for key indicators. A quick glance at my spam folder revealed two different scammers posing as PayPal, notifying me of an urgent need to click a link and verify information.
If you look at the screenshot on the right you will see that the scammer is using the updated PayPal logo, but don’t let that give you a false sense of security. The greeting gives it all away. PayPal will ALWAYS address you formally by the name registered to your account. So if you have a personal account it will be your name, and if you have a business account it will reference your business name. Never as “Dear PayPal Member” or “Account Holder”.
Now that doesn’t mean that a message addressing you correctly is guaranteed to be legit, but it does mean that a message not addressing you directly is an obvious ruse.
Once you get past the greeting, you can also look for mistakes in the copy. In the above example there is an extra period at the end of a paragraph. In the other sample there is a missing return space between paragraphs. These are small things, but a lot of scammers seem to miss them.
Also, both examples urge you to click a link to go somewhere and input information … which most reputable sites won’t ask you to do.
Remember that these aren’t tips to confirm that a message is authentic, but rather clues to easily filter out a lot of the bad ones that aren’t authentic. Ultimately your best bet is open a new window and visit the site how you normally would, and look for any alert messages there. If you have a problem with your account they will usually notify there too.
Hope this helps a little more!
Ryan K.
Community Manager
Yahoo! Mail
- Buzz up
- Subscribe via RSS
- 57 Comments
May 13th, 2008 at 5:25 pm
I like to run my mouse over the link in an email, too, if I have any doubts - Usually the ones that claim to be from PayPal (which I’ve been getting too), or whoever else, will have a totally bogus website that they’re linking too.
I almost fell for the first phishing email I got, even though I knew about them. I started to fill in the info requested, when all of a sudden something didn’t feel right & I looked closer before submitting it.
May 13th, 2008 at 5:51 pm
I have been getting email from overseas, in a lottery scam. From Nigeria, England and other places. Then, to from pitiful old widows seeking money. Please stop this nonsense. It is very annoying. Thanx
May 13th, 2008 at 5:57 pm
I usually get mails from different strange mail ids(they do not exist practically) about winning millions of dollars and to claim. Few of my friends gave their phone numbers and got some wrong calls too. Thanks for the post regarding paypal.
Thank You….
May 13th, 2008 at 9:14 pm
This week alone I’ve received 8 emails either winning overseas lotteries, or help a lawyer with an inheritance, or some kind of scam involving hundreds of thousands, and some are millions of dollars. I can’t imagine anyone falling for any of it, but I guess some people do. I find there’s usually a few misspelt words and words used when it doesn’t make sense to use it and things like that. I’ve spammed all of them and I continue to get them. It’s really annoying.
May 13th, 2008 at 10:05 pm
this is a message I got today, do you know you are cancelling out accounts FOR LIFE?
Yahoo Warning!!! Verify your Account To Avoid it Closed!!!
From: Yahoo Services Alert (alert.services@yahoo-inc.com)
You may not know this sender. Mark as safe | Mark as unsafe
Sent:Tue 5/13/08 6:06 AM
Reply-to:yservices55514@yahoo.com
To: hartongagencyomaha@hotmail.com
Account Alert
VERIFY YOUR FREE YAHOO ACCOUNT NOW !!!
Dear Yahoo Member,
This message is from yahoo messaging center to all yahoo free account owners and premium account owners. We are currently upgrading our database and
e-mail account center. We are deleting all unused yahoo account to create more
space for new accounts.
To prevent your account from closing you will have to update it below
so that we will know that it’s a present used account.
Confirm Your Identity
Yahoo! ID:
Password:
Your Birthday:
Your Country or Territory:
Enter the letter from the Security Image : 6yuak5
Registration Verification Code
Warning!!! Account owner that refuses to update his or her account before two
weeks of receiving this warning will lose his or her account permanently.
Yahoo Mail.
May 13th, 2008 at 11:25 pm
alot of spam says Account Alert i would not worry about it. or you can contact yahoo about it they have phone number it in california. you have to search for it
May 14th, 2008 at 2:43 am
It still baffles me that AnyOne would get pulled into these types of online scams.
We all know what we have signed up for…
We all know that there’s no one in Nigeria that we have EVER had contact with…
And lastly (yes I know a sentence should not start with and) we all have the means to research any of this, since, hey…WE’RE ON THE INTERNET!!! Or should we revert to calling it the ‘World Wide Web’ and sing the praises to Al Gore??
Geez…it just makes me mad that so many can still be that naive!! Or maybe they just like the water!! (naive spelled backwards….)
May 14th, 2008 at 8:42 am
I recieve all kinds of emails with winning notifications I catch the key words like ( cheque)
and the wierd dollar sign that is on front of the amount. If I win an overseas lottary in England thwn why do I have to submit my info to Africa, or Nigeria, don’t make sense to me.
May 14th, 2008 at 9:01 am
Yes, these examples may be phishing attempts. But mind you: PayPal Europe is presently actively phishing. Covered by - or, as they say, forced by - a recently implemented EU directive they are forcing virtually every PayPal client to provide information via fax or upload. Yes, via clickable links. Not only do they request proof of identification, they have also asked me proof of domicile and - Yes! - credit card details. Is this phishing or what?! I have full confirmation from PayPal Europe that these phishing activities are intended attempts by PayPal to gather additional information. The benchmarks used by PayPal for requesting the info do not comply with the EU directive, but PayPal claims, referring to the General Conditions, that they can always ask for information. Moreover, the Dutch language in all of PayPal’s communication (emails, website) with Dutch clients is such that you wouldn’t believe you are dealing with a large multinational bank (yes, they claim to have recently received a bank licence too!) I’m off, to Moneybookers. No hassle, friendly customer service.
May 14th, 2008 at 9:16 am
Ryan - thank you for posting this - - we can never have too much warning to keep us on the lookout for these kinds of “dastardly” tricks!
May 14th, 2008 at 10:47 am
It’s best to get the PayPal security key. It’s their strong authentication solution and even if someone steals your name and password they still won’t be able to login into your account without the hardware token.
https://www.paypal.com/us/cgi-bin/webscr?cmd=xpt/cps/securitycenter/general/PPSecurityKey-outside
May 14th, 2008 at 11:24 am
I see several grammatical errors in the “Yahoo Services Alert” posted above. These are easy giveaways that it is fake!
May 14th, 2008 at 11:29 am
mine from “PayPal” also had a strange sending address
May 14th, 2008 at 11:36 am
I got a new one from IRS(?) taking advantage of the president’s generous jumpstart the economy refund. I was only identified as one of their “undisclosed-recipients” and the message appears flawless. Forget that I’ve already got the refund so I skipped clicking to their given Economic Stimulu Refund site where I would be encouraged to reveal all my financial information. It’s sad that even the IRS can’t do anything about this.
May 14th, 2008 at 11:57 am
I received this fake email. I have been using Yahoo since 2000 and it did not appear something that yahoo would do, therefore, I deleted it.
Thank you,
Robie Irwin-Casanova
May 14th, 2008 at 1:30 pm
The paypal phishers are relentless. I’ve not only received them from different sources, I’ve received them in different languages as well. Hopefully paypal’s security team can find and put an end to these people quickly.
May 14th, 2008 at 1:45 pm
It got so bad with PayPal over three years ago that I closed my account due to security fears. I see things haven’t changed much. PayPal said I would not be able to reopen an account when I close it. I wonder if that policy has changed.
May 14th, 2008 at 2:10 pm
If you get a email from Paypal, you can forward it to spoof@paypal.com and they will let you know if it is real or not, and also they offer you a download thats called iconix, it will scan your mail and let you know if its legit.
This helps me alot
May 14th, 2008 at 4:06 pm
The best thing to do if get something like this is go directly to the web site if you have an account with them to verify information. Otherwise i will call them directly. I would never go thourgh an email even if it is legit. Because you really never know.
May 14th, 2008 at 4:40 pm
Dennis wrote:
“I got so bad with PayPal over three years ago that I closed my account due to security fears.”
They refuse me to close my account (balance: $ 0.01!) as long as I don’t provide information… (:-()
May 14th, 2008 at 4:46 pm
Dennis wrote:
“I see several grammatical errors in the “Yahoo Services Alert” posted above. These are easy giveaways that it is fake!”
That’s what I first thought, but unfortunately I was mistaken. The Dutch (real) PayPal website content and ALL their emails - and presumably those in some other languages - seem translated/written by uneducated and/or non-native speakers…
May 14th, 2008 at 6:32 pm
what i want to know is why do i get emails to my email address w/ my daughters name (who is not even on my account) and also, how i get emails sent to me that do not contain my email address???
May 15th, 2008 at 5:59 am
Why is it so hard to catch these guys?
At some point, they have to collect the data or clear a check or do something to monetize the scam. Maybe finding these people would be a useful thing for government(s) to be doing.
Yahoo, MSN, Google, Ebay, PayPal, IRS et al would have a vested interest in cooperating with this effort by , at the minimum, alerting the appropriate authorities when a new mailing starts.
Catch one or two, charge them with attempted fraud and the number of counts would be the number of spams or a minimum of one million.
We need a very heavy penalty. This stuff has been going on far too long.
May 15th, 2008 at 6:51 am
wow thanks for the reminder! it could happen to anyone so everyones best bet is to not give out anything to anyone. i have a paypal, so i am always careful!
also with all the stimulus checks being given out….people are sending e-mails to everyone asking them to put in info to check the status of your check….DONT do it, it is a scam as well…or so i have heard. everyone will get a check at some point so dont put vital info on a site to find the date!
May 15th, 2008 at 7:35 am
This is why I have an email address linked only to Paypal notifications. Thus when I receive an email claiming to be from Paypal (or other financial institution) in another different account, I immediately know it is a scam.
May 15th, 2008 at 7:54 am
I’ve received several phishing attempts from “PayPaI.com”. If you are looking at this in a sans-serif font, the site in quotes looks like a legitimate link to PayPal.com - they are playing on the fact that an uppercase “i” looks just like a lower case “L” in Arial or Tahoma.
Since I don’t use my work email for anything personal (including eBay and PayPal), I knew that this was a phishing attempt, but the email looked like it could be legit to a naive user.
If you want to verify the links, trying viewing the source of the email in VI or Notepad, or switch the default font to Courier or Times.
May 15th, 2008 at 10:34 am
I get so many of these it’s crazy. People have nothing better to do on the internet then to spam people. I get so many of the lottery ones as well. I keep saying to myself I should be rich by now with all the lottery I’ve won lol.
May 15th, 2008 at 11:42 am
It is nice that Yahoo is attempting to educate customers, but why not implement screening or spam filtering to prevent this type of message from reaching the clients?
May 15th, 2008 at 12:38 pm
I had a similar scam from Microsoft Lottery, which was sending the messages from Europe. I didn’t respond. But I did try to contact Microsoft in Seattle about them. There was no link for reporting scams and no phone number. Has anyone else had this problem with Microsoft?? I go by the rule that if I don’t recognize who sent it, then I don’t open it.
What amazes me is how many get through my Spam Filter on Yahoo Mail. Every day I have offers to enlarge that special part of my male body. I’m female!! I keep marking them as Spam, but I still get new ones. Anyone have same Problem???
May 15th, 2008 at 1:13 pm
Becky wrote:
#what i want to know is why do i get emails to my email address w/ my daughters name (who is not even on my account) and also, how i get emails sent to me that do not contain my email address???
Comment by becky — May 14, 2008 #
Becky, I’m an electronic major: your email address may look like letters, but it is really a URL and the way they are numbered there’s a way to send a message to everyone. It’s a master number for that group and goes to everyone, broadcast to all. It was designed for broadcasting messages to everyone in the company, etc., but spammers have learned to use it too.
May 15th, 2008 at 1:18 pm
Just to answer some of the questions I’ve seen here.
1. Remember these e-mails are not coming from paypal. These are phishers sending out mass e-mails attempting to get your information.
2. The phisers are difficult to catch due to the way they work and where they operate from. Typically they are in countries that do not recognize our laws or ignore them. They also typically ask for your direct bank information so they can debit your account via ACH. When they do this and close the account they used to withdraw the money, investigators are helpless, especially if the bank they use is in one of the countries that don’t care to catch them.
3. When they send an e-mail without your name in the TO: field, you are typically in the BCC (blind carbon copy). The people in the BCC field receive the message but no one in the TO or CC can see those recipients.
May 15th, 2008 at 2:39 pm
Also be careful I got a phishing e-mail with the E-mail address @ Paypall.com, please note the extra L, I notified Paypal which they appreciated and then went after the site. Please remember Paypal and other sites have a reputation to protect and will go after bogus sites that attempt to pose as them.
There is no such thing as defense, there is only offense and countoffense.
May 15th, 2008 at 8:53 pm
Becky has experienced the same SPAM as I have, addressed to my daughter’s name but at my address. I also have been checking their IP addresses with Geobytes. Many of the scam e-mails seem to coming from Germany lately, whereas the SPAM seems to be coming from New York and California. Mousing over the links reveals info that should alert most people, but from the spelling and typos I see in what people write, they probably would not realize anything was wrong in what they receive. It is unfortunate that Yahoo does not have a place to send SPAM/scams that ask me to reply to Yahoo addresses so that Yahoo can cancel their accounts.
May 16th, 2008 at 2:25 am
I recieved a good one a couple of days ago. In my mail the subject was”Question about item #so&so” Thinking my wife might have put up something for bid, I clicked on it.It brought me to a site, and was asking me to give all my info for my paypal account. Knew it was a scam right then. Just want people to be aware that now there are new ways out there where people are trying to get your info.
May 16th, 2008 at 7:15 am
I appreciate the blog. Knock on wood, so far I have avoided all these internet scams. I love the pay pal ones especially. They send me a nice little notice warning me that my paypal account has been compromised. This news would alarm anyone, right? Wrong! I do not have a paypal account so this if nothing else is an obvious sign that its a scam. These scammers are idiots.
Thanks for all the advice, keep it coming.
May 16th, 2008 at 10:09 am
The best way to avoid a lot of these emails is to be careful when giving out your email address. When I purchase something online, I make sure they don’t send me a million emails trying to get my business again. I request my name be removed from their list. I get only a couple of scam emails, so I believe my system works.
May 16th, 2008 at 10:34 am
D Williams, that works if your e-mail never appears on a website (mine showed up on some public listserv posts) and your e-mail address is complex enough not to be randomly found.
May 17th, 2008 at 6:15 am
“It got so bad with PayPal over three years ago that I closed my account due to security fears. I see things haven’t changed much. PayPal said I would not be able to reopen an account when I close it. I wonder if that policy has changed.”
Banks do the same thing. You cannot ‘re-open’ a closed account. But you can open a new account.
May 17th, 2008 at 4:31 pm
Oh my gosh! I get those male enhancer emails too, and I’m a female. They come from some Canadian Pharmacy.Every time I try to opt out’it re-routes me, or says the address doesn’t exist. They are so annoying! Can anyone help? I want to end those emails ONCE-AND-FOR-ALL!
May 22nd, 2008 at 9:40 am
I’m so glad I came across this. I didn’t think I was nuts but I have been curious about the PayPal and the supossed Yahoo Lottery emails. I have never opened them because I thought it wasn’t the normal type of correspondence. I usually have a handful of spam per day get through to my mail instead of going to my spam. I guess it takes all kinds to make the world go round!
May 22nd, 2008 at 3:38 pm
On a related note (scams), exactly what is the deal with “Grouply”? I have been contacted about this so-called “new service” a couple of times now. When I took a first look at it, they wanted my Yahoo password, which of course I did NOT disclose. What’s the deal?
May 30th, 2008 at 12:26 pm
for all mail user !
all scams from nigeria and other countries are trying to get your information.and they are also using trusted u.s company logos even the fbi logos. according to the real fbi, you should report it. go to their website for more info.and check your credit report asap. also get a trusted antivirus and spyware.and run it !.
June 4th, 2008 at 3:13 am
I keep getting email’s that claim I won the American greencard lottery, I have no desire to move to the USA and therefore never entered the greencard lottery.
June 15th, 2008 at 8:07 am
Hey Ryan: In the last few days, I’ve noticed that quite a bit more spam than usual is making its way past the Yahoo filters into my inbox. I get a LOT of spam on one particular account that I have used for years … hundreds per day, and I’ve been happy that Yahoo heretofor has caught — a rough guess — 98 percent of it. The account is still usable, with that level of filtering.
But did something change? Today I’ve already had more than 30 spams make it into my inbox. Not. Good.
June 16th, 2008 at 11:42 am
I agree with Jeff’s posting. Ever since the “bulk” folder was changed into the “spam” folder, I have been receiving more spam and it is showing up in my inbox instead of the spam/bulk folder. Also, why is it that some accounts have the bulk folder (yes, I have more than one account) and others a spam folder?
June 29th, 2008 at 5:57 pm
hi someone is sending me letter about sending them my bank account so that they can doposit money to my accout please help with this problems evey time i go to see my emill i see this preson trying to get my bank information thanks
July 1st, 2008 at 9:22 pm
Can’t the spam filter be set to catch all e-mails with “undisclosed recipient” notations? So far the obvious ones I’ve received have had this and not had my name on them.
Of course I’m unaware of the technical process, but if it is possible, stopping the “undisclosed recipient” messages would certainly catch the majority of my “Spam” and save me a lot of time!
July 1st, 2008 at 9:26 pm
Can’t the spam filter be set to catch all e-mails with “undisclosed recipient” notations? So far the obvious ones I’ve received have had this and not had my name on them.
Barb
July 2nd, 2008 at 6:34 am
Has anyone else received this message? I am so annoyed with this I could just scream.
Dear PayPal Member,
This email confirms that you have paid ResearchAnyone.com $19.95 USD using PayPal.
This credit card transaction will appear on your bill as “PAYPAL *RESEARCHANY”.
——————————————————————————–
——————————————————————————–
Payment Details
Transaction ID: 20433666FG486722N
Total: $19.95 USD
Item/Product Name: Comprehensive Expert Detective Informational Software
Item/Product Number: 922-116
Buyer: Nancy L Cornell
——————————————————————————–
Business Information
Business: ResearchAnyone.com
Contact E-Mail: sales@researchanyone.com
——————————————————————————–
Receipt Number: 0010-8715-4422-2518
Note:
If you haven’t authorized this charge ,click the link below to dispute transaction
and get full refund
Dispute transaction (Encrypted Link )
*SSL connection:
PayPal automatically encrypts your confidential information
in transit from your computer to ours using the Secure
Sockets Layer protocol (SSL) with an encryption key length
of 128-bits (the highest level commercially available)
Keep your Receipt Number (shown above) for future reference. You will need to refer to this number if you need customer service from ResearchAnyone.com or from PayPal.
If you have questions about your purchase, such as shipping and tracking, we encourage you to contact the seller, ResearchAnyone.com at sales@researchanyone.com.
If you have been unable to resolve your questions with the merchant, PayPal offers a free buyer complaint resolution service that offers a quick, easy resolution to your concerns. It covers physical goods purchases made through PayPal, and is offered at no charge when you register for a free PayPal account. To sign up for an account, click on the ‘Save My Info’ link above.
Thank you for using PayPal!
The PayPal Team
Please do not reply to this email. Email sent to this address cannot be answered.
PayPal Email ID PP344
July 19th, 2008 at 2:19 pm
If you have received an email stating that our website has charged you $19.95 via Paypal, please ignore this and DO NOT click on any links inside the email. This is a phishing email. You were not charged anything from us. This email did not come from us. Please forward the email you received to spoof@paypal.com immediately. We are working with them to track the individuals involved. We apologize for any inconvenience this has caused you.
Regards,
ResearchAnyone.com Team
July 2nd, 2008 at 9:57 pm
reply to sherry P
yes! I received the exact same one. dang those ppl
July 11th, 2008 at 10:18 am
I got that so-called alert from yahoo accounts too, warning me my account would be deleted if I didn’t verify my information within two weeks. I forwarded it to the phish email. This was a little more difficult to spot than the usual phishing scams, but I just keep in mind that any email asking for my password is phishy.
July 14th, 2008 at 7:33 am
i get all of these every day. i sympathize with you all. i get ones from nigeria, uk, microsoft, yahoo, some have the nerve to say they are service men stationed in iraq (i am in NY!). these people are low and will stoop to any level to get your information.
one thing i can help you with is who to report the fake paypal to. when you get this one, you can foward it to “spoof@paypal.com”.
July 19th, 2008 at 2:16 pm
YES, SHERRY I HAVE RECEIVED THAT $19.95 MESSAGE - WHO CAN i CONTACT TO STRAIGHTED THIS THING OUT. THANKS. HARRY
July 19th, 2008 at 2:17 pm
YES SHERRY, I HAVE RECEIVED THAT $19.95 MESSAGE. WHO CAN I CONTACT TO STRAIGHTED THIS THING OUT. THANKS
HARRY
July 19th, 2008 at 4:43 pm
It is scary knowing about this fake paypal is out there. Even when I buy things online I don’t have the time to check if the paypal site is authentic. And I consider myself very aware about issues like this. From now on The caution level has to ba raised. I don’t mind spending more time to pay for something than risk being taken advantage of.
July 24th, 2008 at 5:36 am
i did not get an email .a box pop up and said did you want this charge to go through if not despute it i click dispute it then the box went off that was it now what do i do i didn’t give nobody my credit number so how will they charge me i know i’m confuse they charges me 19.95 also