Heads-up for PayPal users: Possible info leak?


Prometheus

Well-Known Member
Joined
Mar 8, 2008
Messages
9,472
For anyone who uses PayPal (sadly a necessary evil, in a lot of cases), or who has friends or relatives who do, I just wanted to post a heads-up.


I received a pretty blatant phishing e-mail earlier, from the blatantly fake address of "service@paypall.com", and with a bullshit reason for wanting information from me. This in itself is unremarkable - it's typical phishing scam stuff. However, that's not why I'm writing this warning. It was quite well-written, but some such e-mails can be, so this in itself wasn't of particular note.


The alarming part is that the e-mail was the fact that it contained my full name (just as genuine PayPal messages do), AND the unique way in which I write my e-mail address specifically for use with PayPal and other sites where I would want to know if information has been compromised.


Of course, the fact that these are being used for a phishing e-mail to try to get into the account and get at the monetary details proves that these are the only bits of info that have been compromised (I know my credit card account to be fine), which is good to know, but the fact remains that this is easily the most convincing phishing message I've ever seen, hence the heads-up here.


If you use PayPal, keep your eyes open. If you know anyone else who does, please make sure that they know, too - ESPECIALLY if they're not aware of scams like this.
 
Last edited by a moderator:
Sounds like someone has cracked open a reasonably big sites paypal records and is using them to run this scam.
 
^ I expect that may be a little extreme. ;) I'm pretty sure that, if the breach is indeed with them in the first place (which as Craig notes, it may well not be), they've only lost some names and e-mail addresses.
 
Paypal has notoriously good security, it's probably as solid as it can be, no one is going to get inside it, unless they are an inside man.


Although they do sometimes do odd things, they are more reliable and trustworthy than, for example, Google checkout.


It will just be some websites paypal records which have been stolen, continuing enough information to make the emails look more genuine. I've never understood why almost every website seems to want to keep these details, often in plain text.


Consider a reasonably large webshop goes bust, and someone buys up their machines, chances are right on there will be a lot of personal information. Company liquidations are like a gold mine to hackers.
 
Last edited by a moderator:
I keep trying to close my account, but then I sell something on ebay or something else only accepts paypal and I'm stuck again. Not that there's really a superior alternative.
 
There is alot of fake text messages and emails going around at the moment.Ive gotten a few fake ones on the o2 mobile network also.If you click on the link it takes you to a page where they ask for your personal details.
 
On the realm of leaks, I just got a spam message from icontact.com (a "legitimate" email marketing company). The spam in itself is not surprising; what is surprising is that it was sent to my specific ebay address. Like others, I have different addresses (really just +thing gmail tags) to keep track of what is coming from where, so I know the only way anyone could have gotten this address is through ebay. I can't even accidentally reply, it would fill in my main address as the reply-to. I am quite certain that the only way that anyone could know what my ebay address is is for them to go through ebay to get it; either ebay is in the business of selling addresses now, or there's a hole somewhere that they are scraping information from.
 
On the subject of spam emails, i've just received one purporting to be from Dell offering me an exceptional deal on watches and jewelry. :D
 
Back
Top