Paypal phishing scam alert
Just received an email which on inspection is an attempt to capture Paypal login details from the unwary:
Quote:
Personal Account Identity Verification
We recently reviewed your account, and suspect that your PayPal account may have been accessed by an unauthorized third party. Protecting the security of your account and of the PayPal network is our primary concern. Therefore, as a preventative measure, we have temporarily limited access to sensitive PayPal account features.
To restore your account access, please take the following steps to ensure that your account has not been compromised:
1. Confirm your identity by completing the account verification process.
2. Click the "Submit" button at the bottom of the page.You will be taken to the Data Security and Encryption page.
3. Login to your PayPal account and review your recent account history for any unauthorized payments sent or received, and check your account profile to make sure not changes have been made. If any unauthorized activity has taken place on your account, report this to PayPal immediately.
To get started, please click the link below:
https://www.paypal.com/cgi-bin/webscr?cmd=account-verification-run
For more information about how to protect your account, please visit PayPal's Security Center, accessible via the "Security Center" link located at the bottom of each page of the PayPal website.
We apologize for any inconvenience this may cause, and appreciate your assistance in helping us maintain the integrity of the entire PayPal system. Thank you for your prompt attention to this matter.
Thank You,
The PayPal Team
Please do not reply to this e-mail. Mail sent to this address cannot be answered. For assistance, log in to your PayPal account and choose the "Help" link in the header of any page.
The hyperlink source code actually points to:
Quote:
http://www.paypal.com%00@goodyes.com/abm/imgs/anim3/index.htm
They are using images in the HTML email which reference the genuine www.paypal.com site.
This is exactly why I despise HTML as an email format, and it is also why I use a separate email address for my various online services - this one was addressed to my personal email address so I know it's not genuine.
FYI this is attempting to take advantage of a hole in IE which displays the URL in the browser only as far as the null code (%00) - it has been fixed (by removing support for "user:password@site" format URLs) so if you're up to date with Windows Updates then you should be okay.
Edit:
Silly automatic URL parsing turned itself back on after preview, d'oh
