Paypal Email Scam

bmurrish · #1 10-25-2005, 06:26 PM

This thread is off topic but hopefully it will prevent a fellow builder from getting scammed like I just did.

I use Paypal all the time to order parts for the plane or get stuff on ebay. I received an email that said it was from Paypal. In the email it said you have added the following email to your account. They give you some bogus yahoo email address. The next line says if you didn't authorize this addition to contact customer service at the link provided. You click on the link and it takes you to what looks exactly like Paypals official website. I mean it is dead on, it even shows paypal.com in the link that comes up (Paypal still can't figure out how they are doing this). They have you log into your account (I found out later you can put anything in the box and it will work). The next box says they are doing routine security maintenance and you must enter your credit card number and expiration, which like an idiot I fell for because it all looked real. After you enter the information it comes back up with the same page. I went about taking care of some other things and them it dawned on me that it might be a scam. I called Paypal and they verified that it was definitely a scam and blocked my account. I hung up with them and called my bank. Sure enough, in the matter about 1 hour the scum bags had opened a fake Yahoo Wallet account, which generates a $1.00 charge to the credit card to verify it as good. I had my bank immediately canceled the card. Thank God I caught it in time. Who knows what I may have bought if I didn't catch on. I really thought I pretty safe and feel really stupid about getting burned. Just goes to show you how tricky crooks can be.

mark manda · #2 10-25-2005, 07:45 PM

Yeah, those paypal e-mails definitely look real.

Did they address you with your actual name? I've heard paypal will ALWAYS email you with your name-- not a version of your email, or user name.

osxuser · #3 10-25-2005, 08:33 PM

The biggest thing about both Paypal and Ebay is that they will NEVER (they say themselves) ask for your credit card number and never ask for your login to be responded by e-mail. (Your's was a bit more tricky because of the link to their site for a "login")

I never follow e-mail links. I know that if it's a legitiment problem, I can log directly into their site and then take care of the problem.

praterdj · #4 10-25-2005, 08:41 PM

t?s a bit unnerving purchasing over the web. I do it all the time but I was looking at a motorcycle on e-bay. The guy said he didn?t have a pay-pal account and wanted the money deposited through some other service and they would pay out only when I called and stated that I was happy with my merchandise.

I e-mailed him and asked if he would use another e-bay recommended pay method and he sent me an e-mail stating if I wanted to do business with him that I had to do it his way.

Thinking this was suspicious I notified e-bay. They responded that afternoon and pulled about 18 or so advertisements from this same guy. Turns out it was a scam and a couple of people had been burned. About 11K each

You have to be careful. If it seems way too good to be true?.it probably is.

rv8ch · #5 10-25-2005, 08:59 PM

I'm sorry to hear you got scammed like this. There are dozens of scams where Paypal, Ebay, various banks, and other institutions try to get you to click on a link. Never click on an E-mail link!!!

There are professional crooks out there that are literally processing scammed information as fast as they can. These are not one-man operations, but huge, professionally run criminal organizations.

If you did not initiate the transaction, meaning going to a website that you typed in yourself, never enter any personal data. With a name, birthdate, and SSN a crook can do just about anything.

Don't forget the "nigerian scam" as well. This has suckered thousands into giving the crooks all their money. It's the deal where someone has millions sitting in a bank "somewhere", and they need your help getting the money out.

Also, there are *lots* of people that have keystroke scanning viruses running on their PC without even knowing it. The crooks are going to process your information, when they get to it. They have *massive* backlogs of data to process. They'll get to yours eventually!

Think of getting onto the internet as sex with a random stranger. Be very careful, and use as much caution and protection as possible!

bmurrish · #6 10-25-2005, 09:38 PM

The thing that gets me is that it was a https site followed by paypal.com. How the heck did they do that? If you pull both sites up side by side they are almost completely identical. That is scary. Lesson learned and best of all no money lost.

Highflight · #7 10-26-2005, 05:09 AM

Spoofing a legitimate URL address isn't particularly difficult for these people, but the easy way to check if an address is real, is when you're on that page, click on File/Properties at the top of your browser and the real address will be shown.

99% of the time, the address shown in Properties is exactly the same as what you see in the Address bar on your screen. However, when a spoofed address, the Properties will show the page where you are REALLY at, and it may not be what your Address bar says.

I get this stuff all the time and sometimes can't help but fill in all the info with various vulgar usernames and passwords.
Real vulgar, if you know what I mean, and the "Verification" form always accepts the stuff. I just can't help myself.

Jamie · #8 10-26-2005, 05:25 AM

This sort of scam in the hacker/computer security world is called 'phishing', since they are sort of fishing for information.

Entering bogus information in their forms is actually a good way to counter this sort of thievery. If everyone that received these e-mails entered bogus information, these criminals would have a very difficult time determining what is real and what is not.

In short, I never respond to an e-mail about some problem with an account, etc. I always open my browser (Firefox, of course) and go directly to the site.

Also, always make sure that the certificate on the server is good. Van's even needs to fix a minor problem with theirs.

Kahuna · #9 10-26-2005, 05:46 AM

Quote:

Originally Posted by Jamie

This sort of scam in the hacker/computer security world is called 'phishing', since they are sort of fishing for information.

Jamie is correct.
This is big big business folks. Keeps me in a job. Our company tracks these and puts blocks on firewalls at litterally hundreds a day. Talk about moving targets.

It is amazing after all that is out there that folks STILL click through their e-mail. Never never do it period.

Jamie · #10 10-26-2005, 06:27 AM

And oh yeah...thanks for sharing the info William. It takes some degree of courage and thoughtfulness to let everyone know that you got taken. I'm glad that you caught it in time.