There has been a new rash of phishing spam which is intended to elicit a shock response causing the target to rush to log into their Paypal account to figure out why they are being charged hundreds to thousands of dollars for an eBay purchase which they know that they didn’t actually make.
Well of course they didn’t actually make the eBay purchase – because it never happened. But the fear that you are about to lose several hundred dollars from your Paypal account ($347.85 in the example below, but we’ve seen them as high as $1200 or more) causes people to not think clearly – and when the email really looks like a legitimate email from Paypal, they are likely as not to click the links in the email so they can get the problem resolved quickly, before “their money” is wrongly sent away.
Of course ironically, the very act of clicking the link and logging in to “Paypal” ensures that all of the money will be drained from their Paypal account. Because what they are really logging in to is a clone site which looks like Paypal, but is being run by the phishers, who capture the victim’s Paypal username and password, and then log in and drain the Paypal account of all of its funds – after also grabbing all of the user’s banking information.
Here’s an example of the Paypal eBay phish that was caught in our net today.
This is the view not that the end user sees with an html-enabled email reader, but the actual, underlying text – see if you can spot the nasty bits:
The Internet Patrol is completely free, and reader-supported. Your tips via CashApp, Venmo, or Paypal are appreciated! Receipts will come from ISIPP.
CashApp us
Venmo us
Paypal us
From: service@PayPal.Inc.com
Subject: Receipt for Your Payment to achaade13@yahoo.com
Dear PayPal Member,
This email confirms that you have sent an eBay payment of $347.85 USD to
achaade13@yahoo.com for an eBay item.
———————————–
Payment Details
———————————–
Amount: $347.85 USD
Transaction ID: 2LC956793J776333Y
Subject: Digimax 130
———————————–
Item Information
———————————–
eBay User ID: scratchandgnaw2
—————————————————————-
Edward Harrell’s UNCONFIRMED Address
—————————————————————-
Edward Harrell
211 David St.
Springtown, TX 76082
United States
Important Note: Edward Harrell has provided an Unconfirmed Address. If
you are planning on shipping items to Edward Harrell, please check the
Transaction Details page of this payment to find out whether you will
be covered by the PayPal Seller Protection Policy.
Note:
If you haven’t authorized this charge ,click the link below to dispute
transaction
and get full refund
Dispute Transaction:
return=http%3A%2F%2Fpaypal-cgi-bin.s6.pl/?
cgi-bin.webscrcmd=_login-run.webscrcmd=_account-run.DisputeTransactionID.2LC956793J776333Y
*SSL connection:
PayPal automatically encrypts your confidential information
in transit from your computer to ours using the Secure
Sockets Layer protocol (SSL) with an encryption key length
of 128-bits (the highest level commercially available)
—————————————————————-
This payment was sent using your bank account.
By using your bank account to send money, you just:
– Paid easily and securely
– Sent money faster than writing and mailing paper checks
– Paid instantly — your purchase won’t show up on bills at the end of
the month.
Thanks for using your bank account!
—————————————————————-
Thank you for using PayPal!
The PayPal Team
PayPal Email ID PP118
—-
The Internet Patrol is completely free, and reader-supported. Your tips via CashApp, Venmo, or Paypal are appreciated! Receipts will come from ISIPP.
CashApp us
Venmo us
Paypal us
This one backfired a tad with me. I woke up to the email in my inbox for a tech accessory for around $200, which is pretty standard for the sort of shit I buy in a depressive mood so I assumed that was the case and filed it in my purchases folder. Few weeks went by, nothing turned up in the mail, I logged in to eBay to complain and couldn’t find the item in my purchased list. Checked the email and finally noticed it was bull.
Ah well.
(Ended up buying the item for real afterwards though.)
HERE ANOTHER EXEMPLE, I GOT IT TODAY.
06 JULY 2015 07:12:01 AEDT
Transaction ID: 501BN114T9564VA10
Hello,
You sent a payment of $49.99 AUD to yesntofirst (firstclassyes7@hotmail.com)
Thanks for using PayPal. To view the transaction details, log in to your PayPal account.
It may take a few moments for this transaction to appear in the Recent Activity list in your Account Overview.
Seller
yesntofirst
firstclassyes7@hotmail.com Note to seller
You haven’t included a note.
Shipping address
Alan Stobbart
176a Calais Rd
Wembley Downs
Western Australia 6019
Australia
Shipping details
The seller hasn’t provided any shipping details yet.
Description Unit price Qty Amount
Mini Ultrathin Credit Card Size Mobile Smart Phone Bluetooth Dial Calls Music
Item number 391188195135 $49.99 AUD 1 $49.99 AUD
Shipping and handling $0.00 AUD
Insurance – not offered —-
Total $49.99 AUD
Payment $49.99 AUD
Payment sent to firstclassyes7@hotmail.com
I paid for an item on 13th March 2010 from lighinthebox. My money was debited from my account and i have not received any word of the status after emailing them many times.
Hey guys if you want the guys, here’s there contact information. Gee, I wish people who use the internet know something about the world wide web before using it. You can always whois.net anybody’s website any given day of the time.
Now if you want to flood their servers or open up a bomb on it, crash the hell out of it, I wouldnt mind. I hope I start an online website crash, because of this single post. Someone want to contact the Better Business burue(sp)? You have their contact information now. paypal.inc.com, if your reading this, kiss my —. IT SERVES YOU RIGHT!
WHOIS information for: paypalinc.com:
[whois.enom.com]
=-=-=-=
Visit AboutUs.org for more information about paypalinc.com
AboutUs: paypalinc.com
Domain name: paypalinc.com
Registrant Contact:
Whois Privacy Protection Service, Inc.
Whois Agent ()
Fax:
PMB 368, 14150 NE 20th St – F1
C/O paypalinc.com
Bellevue, WA 98007
US
Administrative Contact:
Whois Privacy Protection Service, Inc.
Whois Agent (dttvlpltwp@whoisprivacyprotect.com)
+1.4252740657
Fax: +1.4256960234
PMB 368, 14150 NE 20th St – F1
C/O paypalinc.com
Bellevue, WA 98007
US
Technical Contact:
Whois Privacy Protection Service, Inc.
Whois Agent (dttvlpltwp@whoisprivacyprotect.com)
+1.4252740657
Fax: +1.4256960234
PMB 368, 14150 NE 20th St – F1
C/O paypalinc.com
Bellevue, WA 98007
US
Status: Locked
Name Servers:
dns1.name-services.com
dns2.name-services.com
dns3.name-services.com
dns4.name-services.com
dns5.name-services.com
Creation date: 07 Feb 2004 14:10:48
Expiration date: 07 Feb 2009 11:10:48