Subscribe    RSS Feeds    Twitter            Contact Us   
728_header.jpg (23748 bytes)
 Home   EB Blog   AB Blog   Letters   Podcasts   Forums   EPIS   PR Service   Classifieds   EKG   Ratings 
Web Site     
  Rate Services
  Amazon Fee Calculator
  eBay Fee Calculator
  Etsy Fee Calculator
  Auction Calendar
  Collectors' Links
  eBay Promo History
  Bookshelf
  Fraud Resources
  Drop-Off Store Laws
  Payment Holds
  Ecommerce Resources
  Photo Tips
  Marketing Inserts
  Yellow Pages
  Advertising
buyersmarket2aaa2.JPG (7729 bytes)
EcommerceBytes Letters to the Editor Letters to the Editor
Your emails to EcommerceBytes
For consideration, send your email to ina@auctionbytes.com with "Letters to the Editor Blog" in the subject line! Remember to include your name as you would like it to appear in the blog.
Thu Oct 21 2010 21:23:47

Beware Spoof PayPal Emails Containing Your Full Name

By: Ina Steiner
Sponsored Link
To the Editor
I need to warn PayPal members of a scam being perpetrated on users but being ignored by PayPal.

I received what appeared to be a very valid email from PayPal that included my full name. Other than having 3 links in the email, most people would have believed it to be from PayPal. Thankfully, I checked full headers and realized it had to be a scam. I copied and pasted full headers into the email, then forwarded it to spoof@PayPal.com. I got no response. Three to four days later, I received an identical email and again forwarded it to PayPal. Finally today, I received a "form email response", confirming it was not sent by PayPal, even though it contained my first, middle and last name. Your readers should be aware of this scam.

While writing this, I had a light bulb moment. Many people including me, use "signatures" at the bottom of their emails. Mine includes my full name, company name, website link and phone numbers, something I will stop immediately. It wouldn't take a rocket scientist to check my website, see I accept PayPal, then send what appeared to be a legitmate email from PayPal that included my full name.

I would be willing to bet other readers have fallen prey to this scam. Please urge your readers
1-Don't click on any links
2-Always check full headers
3-Stop using signatures with detailed information.

Regards
Ann




Comments (19) | Permalink
Readers Comments

Beware Spoof PayPal Emails Containing Your Full Na   Beware Spoof PayPal Emails Containing Your Full Na
by: Janet
       
Thu Oct 21 22:20:19 2010
I got one this week, also with my first and last. It claimed to be from a buyer regarding an item I did not sell. It stated that it had been 2 weeks since he had paid, and that if I didn't respond they would be contacting the FBI. It also had a link to PayUnPal. Nice try, but didn't fool me!
Beware Spoof PayPal Emails Containing Your Full Na   Beware Spoof PayPal Emails Containing Your Full Na
by: Rick1313
       
Fri Oct 22 01:14:02 2010
This post is a basic email 101 course that cannot be taught too often.

Especially as there are always new users coming onto the internet everyday.

Some, just to do ecommerce business.

These type of users, who just want to know the bare basics they need to operate on the internet, are the most vulnerable.
Beware Spoof PayPal Emails Containing Your Full Na   Beware Spoof PayPal Emails Containing Your Full Na
by: SlowResponce
       
Fri Oct 22 04:25:23 2010
The scary part is someone felt comfortable enough they could use paypal to scam you. Maybe because if you realized instantly what happened they could clean you out and do a lot of damage before paypal responded.
Beware Spoof PayPal Emails Containing Your Full Na   Beware Spoof PayPal Emails Containing Your Full Na
by: rjr
       
Fri Oct 22 05:22:06 2010
The newest one I've seen is a paypal echeck they are very good right down to a honest item number of a item you have listed your name and a brief explanation about waiting for it to clear before shipping and if you're having problems claiming it to go to the links provided due to paypal having some site issues... and with more that 80,000 items sold over 12 years it almost fooled me...
Beware Spoof PayPal Emails Containing Your Full Na   Beware Spoof PayPal Emails Containing Your Full Na
by: Brownie
       
Fri Oct 22 09:59:07 2010
Seems like a lot of folks are affected by this.  Just how does this happen?  How can a scammer tie your Paypal user name and real name with your Ebay account user name and real name?  And why is Paypal so indifferent about this concern?

Seems like every time I transfer funds from Paypal to my bank acct, I get a phishing email (credit card/frozen acct). I'm so convinced it's an inside job.
Beware Spoof PayPal Emails Containing Your Full Na   Beware Spoof PayPal Emails Containing Your Full Na
This user has validated their user name. by: Ed Gadfly
       Web Site
Fri Oct 22 10:56:18 2010
Can't wait to get the new PreyPal app for my Droid.
Beware Spoof PayPal Emails Containing Your Full Na   Beware Spoof PayPal Emails Containing Your Full Na
by: buck efay
       
Fri Oct 22 11:25:37 2010
Is it from that guy Vladuz that hacked Ebay?
Beware Spoof PayPal Emails Containing Your Full Na   Beware Spoof PayPal Emails Containing Your Full Na
by: Kevin M.
       
Fri Oct 22 11:49:26 2010
My husband has configured a filter on my email program that analyzes the ''header'' information in emails.

A valid email from PayPal (or from eBay) will include some specific header information that 99.999% of fraudulent emails will not contain.

I think the filter is looking for headers that contain information on specific email servers and ''routes'' (or routers?) that always appear in VALID email messages from PayPal or eBay.

If there is a mis-match (ie: the return address includes ''paypal.com'' but the correct header information is missing) then the email is sorted to a ''Possible Fraud'' mailbox for further investigation.

To date, this filter has a 100% accuracy rating. Fake emails are ALWAYS filtered.

It takes a little effort to protect yourself, and I'm fortunate to have someone who can do it for me.

Beware Spoof PayPal Emails Containing Your Full Na   Beware Spoof PayPal Emails Containing Your Full Na
by: Ann
       Web Site
Fri Oct 22 15:27:14 2010
I wrote the original letter to Ina and I'm convinced, this particular type of scam is generated by ''dumb'' people like myself, using SIGNATURES with too much info. The crook knows your website, checks to see if you accept PayPal, knows your full name and then sends a very professional email appearing to be from PayPal. This letter was about Policy changes, no misspelled words, no errors of any kind and would have fooled 90% of the public.
WARNING: DON'T USE SIGNATURES THAT PROMOTE YOUR WEBSITE AND INCLUDE YOUR FULL NAME. At least that will stop this one particular Scam.
Ann
Beware Spoof PayPal Emails Containing Your Full Na   Beware Spoof PayPal Emails Containing Your Full Na
by: Rick1313
       
Sat Oct 23 09:30:23 2010
Speaking of questionable emails...

Last May I opened an unpaid item case against a buyer. A short while later, I received three successive emails in my spam email folder.

All were claiming to be from eBay and stating that I wanted to change my address, with links and the whole shebang.

I said to myself, ''!?!?!?''.

Looked legit. Went to eBay messages, but nothing was showing.

As the timing may have been a coincidence, I was giving eBay and the buyer the benefit of the doubt that neither party was trying to pull something.

I did keep the spam emails just in case.

Later on that month, I had to open another unpaid item case (different buyer id and address).

The same thing happened.

The same three eBay messages came in my spam email box.

Now this is not a coincidence and I do not believe that it is buyer(s) trying to pull a fast one on me.

It was eBay's system that was issuing the emails from opening the UPI's and my system security that did not like what eBay was sending.

Neither did I as it had nothing to do with the UPI's.

No use contacting eBay (this all happened before eBay's current attempt at blocking users from contacting them) as they will say anything that they feel protects their liability in a matter.

Since then, other UPI's were opened and closed without incident.

The is the only time, being 4 1/2 years on eBay, that I had eBay issued emails show up as spam. In this case, they contained false information.

So the six emails are kept (and hard copied) in case they may be needed in the future.

One never knows what can come in handy in a lawsuit.

I am posting this to show users that even the selling venue itself can send questionable emails.

And just to show that I am not ''picking'' on eBay...

In an email correspondence with another selling venue, one of their replies came into my spam folder. I did not use it to return my reply.
Beware Spoof PayPal Emails Containing Your Full Na   Beware Spoof PayPal Emails Containing Your Full Na
by: Mercy the Mingless This user has validated their user name.
       
Sat Oct 23 15:37:58 2010
I have received PayPal phishing emails that contain my PayPal registered full name over the past few years. I do not use signatures.

PayPal is aware that scammers have PayPal user names yet PayPal's on hold recording message still tells callers that any email from PayPal that contains the PayPal registered account name is ''authentic'' and can be trusted.

PayPal has known about this breach for years.
Beware Spoof PayPal Emails Containing Your Full Na   Beware Spoof PayPal Emails Containing Your Full Na
This user has validated their user name. by:
       
Sun Oct 24 10:39:54 2010
Don't rely upon paypal to alert you to the fact that they are breached. They were hacked for 2 whole years, during which time they denied and blamed the users. (and this is just one case of many) Read it carefully.

"A security flaw in the PayPal web site is being actively exploited by fraudsters to steal credit card numbers and other personal information belonging to PayPal users. The issue was reported to Netcraft today via our anti-phishing toolbar.

The scam works quite convincingly, by tricking users into accessing a URL hosted on the genuine PayPal web site. The URL uses SSL to encrypt information transmitted to and from the site, and a valid 256-bit SSL certificate is presented to confirm that the site does indeed belong to PayPal; however, some of the content on the page has been modified by the fraudsters via a cross-site scripting technique (XSS)."

http://tinyurl.com/pncdo
http://preview.tinyurl.com/
pncdo

"Responsible
Disclosure? - Paypal vulnerable for two years"
http://tinyurl.com/2fxdls
http://preview.tinyurl.com/2fxd
ls


The
best indicator of current behavior is past behavior.
Beware Spoof PayPal Emails Containing Your Full Na   Beware Spoof PayPal Emails Containing Your Full Na
by: Gene
       
Sun Oct 24 10:50:01 2010
I asked Paypal three times to confirm that the email I rec'd was a spoof, even though it included my full name. I never got a response, which I thought was very unusual.
Beware Spoof PayPal Emails Containing Your Full Na   Beware Spoof PayPal Emails Containing Your Full Na
by: ebay nonsense
       
Mon Oct 25 02:19:50 2010
@ Gene

The spoof@paypal address and the spoof@ebay address is not monitored by people, it's a program that checks the mail headers.  You need to forward the email without adding anything. If you ask a question it changes the original mail headers. Just forward it intact.
Beware Spoof PayPal Emails Containing Your Full Na   Beware Spoof PayPal Emails Containing Your Full Na
by: andanotherthing
       
Mon Oct 25 07:55:16 2010
This doesn't just affect US sellers etc.  I am based in the UK and I had one yesterday, telling me that under UK legislation, Paypal is obliged to send certain verified information about me to the relevant authorities.  The email invited me to click on a lick and provide the information requested (up to date personal details).  I didn't but went to my Paypal account direct check.  No notices there.
Beware Spoof PayPal Emails Containing Your Full Na   Beware Spoof PayPal Emails Containing Your Full Na
by: Ann
       Web Site
Mon Oct 25 12:18:40 2010
To Gene:
Copy and Paste Full Headers above the email BUT above that, put your question, concern etc. Also document the same information, directly on PayPal help emails. I got a useless response but I'm 100% SURE, SIGNATURES are causing the particular problems I had with my full name showing. I've gotten thousands of other's but none with my Full Name, until this scam. If you use SIGNATURES, they can put that in their scam email and make it appear legit.
Ann
Beware Spoof PayPal Emails Containing Your Full Na   Beware Spoof PayPal Emails Containing Your Full Na
by: Fruity This user has validated their user name.
       
Mon Oct 25 15:30:30 2010
contact the Electronic Frontier Foundation and the Electronic Privacy Information Center . ask them to inquire whether this is a data breach. That many people getting these...
Beware Spoof PayPal Emails Containing Your Full Na   Beware Spoof PayPal Emails Containing Your Full Na
by: WESTCOASTROAR This user has validated their user name.
       
Tue Nov 23 14:28:07 2010
Just recently I have had 3 jabs real hard at my stars! first off, i ship daily and fast, they got me on that, since they had free shipping, well to cut to the chase. I finally got to the Top of Ebay, so they could tell me those 3 people were in my blocked list, which was the reason, I called them anyway. Yet, the Representative was cheery, and got 2 others from Trust & Safety to tag along through this No Reason For This Happening Week. Well, they figured out the 3 people had changed one letter in their screen name, and put some numbers in, and left me with a 4.2 4.1 3.9 and 4.0. prior to them, i stayed at 4.95 always. Well, then comes a brain wave from one that says, can they do this to him? Well, let's look it up, No it can't be done. So I am hanging by my thumbs of being told by 3 top honchos not in disney land that hoehoe says no, it's not legal. If I did this I would be suspended immediately, no doubt. I asked what could I do about this, and how can we fix this problem? I was told to have faith in ebay. Now I am fuming because another bad boy got out of block did the same thing, and it's all honkey dorey. I feel like I am trippin.. so one tell me what's up?? Please need to be informed. My PS is gone and TRS.
Beware Spoof PayPal Emails Containing Your Full Na   Beware Spoof PayPal Emails Containing Your Full Na
by: PayPal's DB must have been stolen
       
Fri Dec 10 06:20:45 2010
I noticed a spoofed e-mail from PayPal last week and then found another five similar e-mails in my mailbox (first one from May 2010) while investigating the one I noticed. Some of these e-mails were even send to an e-mail address that I don't actively use for years, I just had it associated with may PayPal account for a few weeks long time ago.

However, I've never used signatures with any of these e-mail addresses (these are personal ones, I use signatures only with business/personal business accounts), so I don't see any other explanation that this is an inside job, there's just no other source of my full name and the knowledge of which two e-mail accounts (out of more than 20 that I use) were associated with my PayPal account.

Therefore I've already zeroed internet payment limits for the CC that's known to PayPal and are very carefull not only when dealing with PayPal e-mails but also when dealing with PayPal in general.


Login is required to post comments.
To sign in to leave a comment using your AB Verify User Name, fill in the form below. If you have not yet signed up for AB Verify, or if you'd like more information, go to the Registration Page
.

Login for AB Verify
Be sure and use your email address and password to log in.

 
Email:
Password:
 
 Forgot Your Password?
 Even though you are signed in with the AuctionBytes Blog, you will have to sign in to the EcommerceBytes blog. But you can sign in with your existing AB Verify info.
 Letters Blog Recent Posts 
 Letters Blog Recent Comments 


Subscribe in a reader

Archives

 
About Us      Privacy Policy & Terms      Link to Us      Partners      Our Writers      Write for Us      Press        Site Index

Copyright 1999-. Steiner Associates LLC. All rights reserved.
 




Powered by Perl Web Blog
© 2005/2014 Ranson's Scripts