Unable to process a password change ! - Phishing warning

[french frank]

No, not on this forum, but a warning to those who ever use PayPal (currently apologising for crediting a customer with over $1 trillion). I've just had an email from (the real) them, confirming a new attempt at phishing which I couldn't find on hoaxslayer &c - and even if it is ... this is it:

An email comes from 'PayPal Inc' telling you that a request to change your password has been unsuccessful and giving an the IP address for the request (in Leicestershire on this occasion). If you have not attempted to change your password:

Please take advantage of our verification process and decrease your fraud risks

What you can do to minimise fraudulent transactions?
1.Download the attached document and open it in a secure browser .
2.Follow the instructions.

In spite of the PayPal logo, it seemed wrong - 'Dear customer' rather than my name and not the usual paypal address (it was apparently an 'ebay' address).

Anyway, PayPal says they're working on it. But meanwhile check before you download anything - and certainly don't 'confirm your password' anywhere.

The phishing email has arrived again this morning.

[johnb]

I've also received a phishing Paypal e-mail, though in my case it was telling me that a transaction was rejected and giving me various links to click on. These would have directed me to hppts://email-edge.paypal.com/...... sites (not actual Paypal websites). The e-mail itself purports to be from paypal@e.paypal.co.uk (note the "e.paypal" instead of "@paypal.co.uk".

I haven't downloaded the pictures associated with the e-mail (I never download the pics on an e-mail unless I am sure it the e-mail is genuine) but the rest of it looks pretty convincing. If I hadn't read ff's post I might have been somewhat less suspicious that I was.

If anyone gets something like this from any financial institution never, ever click on any of the links. If you want to check whether there is a problem with your account then log on to the financial institution's website using your normal method.

[Later Edit]
I tried to forward the e-mail to spoof@paypal.co.uk (following the advice in the Paypal Help Centre). However I can't forward it without downloading all the pictures associated with the e-mail. This, of course, would inform the sender that my e-mail address is valid and potentially open myself up to even more dubious e-mails. So, with regret, I decided not to forwarded the e-mail to Paypal.

[french frank]

[Later Edit]
I tried to forward the e-mail to spoof@paypal.co.uk (following the advice in the Paypal Help Centre). However I can't forward it without downloading all the pictures associated with the e-mail. This, of course, would inform the sender that my e-mail address is valid and potentially open myself up to even more dubious e-mails. So, with regret, I decided not to forwarded the e-mail to Paypal.

That might explain why I got a second email this morning, though the spurious logo was the only image.

Having had a genuine email from PP only a few days ago (addressed to me by name and pointing out that I hadn't properly completed a task that I had started :-) ) I did think this one genuine for as long as it took to look at the logo.

It's the first time I've had a reponse from spoof@paypal which is why I thought it must be a new one. Posting details here will show them on the internet for others: I had googled the subject title and got nothing.

[Dave2002]

Have you ever had the one purporting to be from a friend (someone who travels a lot), saying they are stuck in an airport without any money?

I had one, which looked plausible, so I sent an encouraging email back - but not one which volunteered any money etc., and amusingly I got a reply from the perpetrator(s). I probably just left it at that point, though one could obviously send a "get stuffed!" message at that point. I had, of course, in the meantime checked to see whether my friends had in fact had any problems.

It was a pain, apparently, and it has also happened again since. Just about everyone on their contact list got hit, and there were consequences for some of them - though not direct financial ones I believe.

[johnb]

It's the first time I've had a reponse from spoof@paypal which is why I thought it must be a new one. Posting details here will show them on the internet for others: I had googled the subject title and got nothing.

There are reports on the PayPal forum of similar (though not identical) phishing emails from e.paypal going back to 2011.

However, the information on Google is confusing. Some people say that e-mails from e.paypal.com are genuine, others say they are phishing scams. The best advice is never to click on any link on an e-mail relating to a financial institution but go direct to the website.

[Nick Armstrong]

The best advice is never to click on any link on an e-mail relating to a financial institution

...


(Mind you, you might just miss out http://www.independent.co.uk/news/wo...n-8716484.html )

[french frank]

Have you ever had the one purporting to be from a friend (someone who travels a lot), saying they are stuck in an airport without any money?

Not from real friends but from people with whom I was vaguely acquainted. I felt it was up to their real friends and family to help them out anyway

PayPal is a frequent victim of these scams. I note there was NO link at all in the email they sent to me, other than the email address I'd just used to contact them:

"Thanks for forwarding that suspicious-looking email. You're right - it
was a phishing attempt, and we're working on stopping the fraud. By
reporting the problem, you've made a difference!
Identity thieves try to trick you into revealing your password or other
personal information through phishing emails and fake websites. To learn
more about online safety, click "Security Center" on any PayPal webpage.
Every email counts. When you forward suspicious-looking emails to
spoof@paypal.com, you help keep yourself and others safe from identity
theft.
Your account security is very important to us, so we appreciate your
extra effort."

[Dave2002]

Not from real friends but from people with whom I was vaguely acquainted. I felt it was up to their real friends and family to help them out anyway

Probably best not to have anything to do with the spammers - my "mistake" was to reply, though as far as I know there hasn't been a major problem. I was nevertheless amused to see the response. The more people who know about this one the better.

One which I read about in a recent Times was scary, and someone got suckered in. That was a phone scam. I think someone was phoned by someone pretending to be from the security department from their bank. The bit where things really went wrong was that the victim was asked to call another phone number. This was the number on his/her bank card, so should have been safe.

It seems that some of the phone scammers have ways of keeping the phone line open, so when an attempt is made to dial a perfectly legitimate number, it is intercepted by one of their accomplices. So, if you are ever cold called called by anyone and start to believe them, even if they ask you to phone a number which seems genuine, take care.

[Don Petter]

It seems that some of the phone scammers have ways of keeping the phone line open, so when an attempt is made to dial a perfectly legitimate number, it is intercepted by one of their accomplices.

All they have to do is not ring off! Anyone can do that and keep a line open.

It's having the accomplice on the same line, who appears to answer the 'second call', which is the trick.

Further thought: Presumably under these circumstances there is no dialling tone before the 'second call' is dialled, which should raise suspicion?

[Dave2002]

All they have to do is not ring off! Anyone can do that and keep a line open.

It's having the accomplice on the same line, who appears to answer the 'second call', which is the trick.

Further thought: Presumably under these circumstances there is no dialling tone before the 'second call' is dialled, which should raise suspicion?

Maybe they can spoof the hang-up, and then the subsequent dialling tone?