PAY Pal scam

[Elie]

FOLKS BE VERY VERY CAREFULL, and I know you will, I just got a an email about my PAY-PAL account that was compromized.

Here is the note...

------------------------------------------------------------------------------------------
Dear valued PayPal member:



PayPal is committed to maintaining a safe environment for its community of
buyers and sellers. To protect the security of your account, PayPal employs
some of the most advanced security systems in the world and our anti-fraud
teams regularly screen the PayPal system for unusual activity.

Recently, our Account Review Team identified some unusual activity in your
account. In accordance with PayPal's User Agreement and to ensure that your
account has not been compromised, access to your account was limited. Your
account access will remain limited until this issue has been resolved. This
is a fraud prevention measure meant to ensure that your account is not
compromised.

In order to secure your account and quickly restore full access, we may
require some specific information from you for the following reason:

We would like to ensure that your account was not accessed by an
unauthorized third party. Because protecting the security of your account
is our primary concern, we have limited access to sensitive PayPal account
features. We understand that this may be an inconvenience but please
understand that this temporary limitation is for your protection.

Case ID Number: PP-040-187-541

We encourage you to log in and restore full access as soon as possible.
Should access to your account remain limited for an extended period of
time, it may result in further limitations on the use of your account.

However, failure to restore your records will result in account suspension.
Please update your records on or before May 27, 2005.

Once you have updated your account records, your PayPal session will not be
interrupted and will continue as normal.

To update your Paypal records click on the following link:

https://www.paypal.com/cgi-bin/webscr?cmd=_login-run

Thank you for your prompt attention to this matter. Please understand that
this is a security measure meant to help protect you and your account. We
apologize for any inconvenience.


Sincerely,
PayPal Account Review Department



PayPal Email ID PP522


Accounts Management As outlined in our User Agreement, PayPal will
periodically send you information about site changes and enhancements.

Visit our Privacy Policy and User Agreement if you have any questions.

http://www.paypal.com/cgi-bin/webscr?cmd=p/gen/ua/policy_privacy-outside

---------------------------------------------------------------------------------------------------

Note: the URL: https://www.paypal.com/cgi-bin/webscr?cmd=_login-run
Has a hyper link to http://211.45.97.153/paypal/

So BE CAREFULL!! I tried the link and it's dead but still!

Regards,
Elie

[ZokesPro]

I've gotten one from PayPal and eBay that is very similar to that one, but it linked to porn.

[Lizzard[MPE]]

that sorta looks like the one i received that was actually not from ebay

[Lizzard[MPE]]

this was the reply back i got from ebay


Hello,

Thank you for writing to eBay regarding the email you received.

Emails such as this, commonly referred to as "spoof" or "phished"
messages, are sent in an attempt to collect sensitive personal or
financial information from the recipients.

The email you reported was not sent by eBay. We have reported this email
to the appropriate authorities.

In the future, be very cautious of any email that asks you to submit
information such as your credit card number or your email password. If
you are ever concerned about an email you receive from eBay, open a new
Web browser, type www.ebay.com into your browser address field, and
click on the "site map" link located at the top the page to access the
eBay page you need.

If you have any doubt about whether an email message is from eBay,
please forward it immediately to spoof@ebay.com. Do not respond to it or
click any of the links. Do not remove the original subject line or
change the email in any way when you forward it to us.

If you have already entered sensitive financial information or your
password into a Web site based on a request from a spoofed email, you
should take immediate action to protect your identity and all of your
online accounts. We have developed an eBay Help page with valuable
information regarding the steps you should take to protect yourself.

http://pages.ebay.com/help/tp/isgw-account-theft-reporting.html

To review eBay's new tutorial about Spoof Emails, please see the
following Web page:

http://pages.ebay.com/education/spooftutorial/

To help you better protect yourself from fake eBay and PayPal Web sites,
we have developed a feature for the eBay Toolbar called "Account Guard."
Account Guard includes an indicator of when you are on an eBay or PayPal
Web site or a known spoof (or "phishing") site, buttons to report fake
eBay Web sites, and a password notification feature that warns you when
you may be entering your eBay password on an unverified site.

To learn more about the eBay Toolbar with Account Guard go to
www.ebay.com, click on "Downloads" at the bottom of the page, and then
click on the "eBay Toolbar" link.

Once again, thank you for alerting us to the spoof email you received.
Your efforts help keep eBay a safe and fair place to trade.

Regards,

Ande
eBay SafeHarbor
Investigations Team
______________________________
eBay
The World's Online Marketplace! ®
*******************************************

Important: eBay will not ask you for sensitive personal information
(such as your password, credit card and bank account numbers, Social
Security numbers, etc.) in an email. Learn more account protection tips
at:

http://pages.ebay.com/help/confidence/isgw-account-theft-protection.html

_____________________________________________

For our latest announcements, please check:

http://www2.ebay.com/aw/announce.shtml

_____________________________________________

In order to better serve you, we'd like to occasionally
request feedback on our service. If you would rather
not participate, please click on the link below and send
us an email with the word "REMOVE" in the subject line.
If that does not work, please send an email to the
email address below. Your request will be processed
within 5 days.

mailto:cssremove@ebay.com

*******************************************

[Brian Ellis]

Be warned, the advice given by ebay is not necessarily foolproof. Phishers are getting clever. Please allow me to quote a paragraph I wrote recently for an article in a technical journal:

Regular readers are used to my security rants. Please allow me to re-visit the problem of “phishing”. The last time I wrote about this, it was still called “fishing” and was in its infancy. Let me remind you what it is. You receive an e-mail purporting to come from your bank or another trusted person, asking for a confirmation of some details through an https page on their web site, with a link to it. This may be relatively banal, such as to obtain details for targeted advertising but, more often than not, it seeks bank account numbers, user IDs, passwords, credit card details and so on. “Phishers” have become very astute at their métier and it may be almost excusable to be tempted to fall into the trap set by these criminals, under some circumstances. They make the “419 Nigerian scammers” look primitive in comparison, and we all know that even they are sometimes successful in extorting money from the gullible. For example, the “phishers” clearly show in their message that the hyperlink to their web site is that of the URL you are familiar with but if you look at the Hyperlink Properties (how many people would?), you will probably see that it goes to an IP number. If you click on this, it is a pixel-by-pixel reproduction of the page you would normally see. However, there is worse to come. The original e-mail message asking you to co-operate will contain a tiny HTML sequence that will contain the QHosts Trojan. If you then type the real URL of, say, your bank, the internal DNS Hosts file in your PC will cause it to be shunted to the “phisher’s” site. This is a terrible security flaw in Windows that has not been widely publicised and is certainly valid for all versions of Windows up to XP SP1. I do not know whether it is the case for the relatively recent SP2. To mitigate the danger, many firewalls and anti-malware utilities lock the Hosts file against unauthorised changes so, if you have taken my past advice and installed these, the risk is minimised.

This danger is particularly acute if you use MSIE for your browsing, as it will use its ActiveX features to aid and assist the scammers. This alone will be good enough reason not to use IE or, if you must, disable ActiveX in IE.

[The PIT]

Most sites are now very clever and you have to look closely at the html. I've seen links that reseamble the banks link and a quick look and you'd miss it. I only look to see how good they are as I know my bank wouldn't email me at work. They don't have my address for one which is the real give away.

Anyway if the sites good enougth I fill in a load of false details like fucyou for a password etc.
User names like Donkeysucksyoudick.

The last one I had they couldn't even spell one word correctly.