Wow - kickass new Paypal scam

[hippietim]

I got an e-mail from "Paypal". It was one of those "you just paid" e-mails. So I'm looking at this thing going WTF?!?!? I didn't buy any %$#%#@#$ "Cape Cod Collection by Avon 42 pieces". So I clicked the link. D'oh. No worries that was the one and only link that didn't point to the scam site. The "Dispute Transaction" link on the other hand...

I didn't read the message from the beginning - if I had I would have seen one of the tell tale signs of a scam "Dear Paypal Member" - all correspondance from Paypal will have your real name (at least the one you gave Paypal).

Watch out kids - the douchebag scum sucking fucks are getting better.

[gemini8026]

Re: Wow - kickass new Paypal scam

Even the most seasoned computer vets fall for it every now and then. The other day I opened what I thought to be a set of patches for one of my guitar rig programs turned out to be 15 spyware/adware virii from hell executables!!! Took me over an hour running ad-aware in safe mode as well as a few norton scans and manual regedit's to get the computer to settle down!

[wulfe13]

Re: Wow - kickass new Paypal scam

Yeah I had the same kinda paypal scam sent to me about 2 months ago... I hate these fucking scammers!!! I'm so sick of SPAM too... I think it should be illegal to send unsolicited eMails!

[xenophobe]

Re: Wow - kickass new Paypal scam

[ QUOTE ]
Even the most seasoned computer vets fall for it every now and then. The other day I opened what I thought to be a set of patches for one of my guitar rig programs turned out to be 15 spyware/adware virii from hell executables!!! Took me over an hour running ad-aware in safe mode as well as a few norton scans and manual regedit's to get the computer to settle down!

[/ QUOTE ]

If you don't have a way to scan for rootkit software, i.e. rootkit revealer... there's a good chance you're probably still infected...

[lerxstcat]

Re: Wow - kickass new Paypal scam

I never click a link on an email from Paypal or Ebay, because they tell you never to do that on their website.

I always forward them to [email protected] o0r [email protected]
and then delete them. Later I go to the website concerned and login to see what's up.

[charvelguy]

Re: Wow - kickass new Paypal scam

There was one I received on Thanksgiving which looked like a payment received email which said I had a charge on my credit card for a watch for over 300.00.

..I almost fell for it until I got to the 'click to dispute' link...it was then I decided to check Paypal first just in case before I go clicking any links...sure enough, the whole thing was bogus.

The killer was that it was sent on a Holiday, very pointed and clever of them to phish me out on this day as there was no one at paypal to send back a confirmation of a spoof email being sent to them for at least the next couple days.

[OnlineStageGear]

Re: Wow - kickass new Paypal scam

I get that one to Tim. There is also a similar one that asks if you are still interested in an item. The thing that distinguishes those from legitimate ones is they have a dispute button right in the email and legitimate PayPal Money Sent notifications have no such thing. You can hover your mouse right over the link and it shows the URL in the lower left. If it doesn’t start with HTTPS://WWW.PAYPAL.COM, it’s a scam.

Matt

[Tekky]

Re: Wow - kickass new Paypal scam

I always send these e-mails to [email protected] and let them go from there. If I have a question regarding something within an e-mail I always verify it by opening paypal with a different browser and never from a link in an e-mail.

[rjohnstone]

Re: Wow - kickass new Paypal scam

[ QUOTE ]
If it doesn’t start with HTTPS://WWW.PAYPAL.COM, it’s a scam.

Matt

[/ QUOTE ]
Actualy... the URL needs to end that way.
Most bogus URL's are things like (https://www.paypal.com.badguy.site.com/)
People see the beginning and think it's good... it's not.
It's what's at the end that counts.
It must end in paypal.com. Anything before it would be a sub-domain of paypal.com and would be legitimate.
All the phishers do is create a www.paypal.com sub-domain under their badguy.site.com parent domain to try and fool you.
Most people don't understand how the internet domain naming structure works, so it's easy to confuse the average surfer.

[Immortal]

Re: Wow - kickass new Paypal scam

[ QUOTE ]
Even the most seasoned computer vets fall for it every now and then. The other day I opened what I thought to be a set of patches for one of my guitar rig programs turned out to be 15 spyware/adware virii from hell executables!!! Took me over an hour running ad-aware in safe mode as well as a few norton scans and manual regedit's to get the computer to settle down!

[/ QUOTE ]

You probably know this now ... But everything you download from internet, check with the virus scan and ad-aware. It takes you a minute but saves hours of re-establishing the system.

[SeventhSon]

Re: Wow - kickass new Paypal scam

[ QUOTE ]
[ QUOTE ]
If it doesn’t start with HTTPS://WWW.PAYPAL.COM, it’s a scam.

Matt

[/ QUOTE ]
Actualy... the URL needs to end that way.
Most bogus URL's are things like (https://www.paypal.com.badguy.site.com/)
People see the beginning and think it's good... it's not.
It's what's at the end that counts.
It must end in paypal.com. Anything before it would be a sub-domain of paypal.com and would be legitimate.
All the phishers do is create a www.paypal.com sub-domain under their badguy.site.com parent domain to try and fool you.
Most people don't understand how the internet domain naming structure works, so it's easy to confuse the average surfer.

[/ QUOTE ]

No, you have to look at the whole URL, because it could be like:

http://www.badguysite.com/stealmoney...www.paypal.com

or something like that...they'll put the good url in the querystring.

[OnlineStageGear]

Re: Wow - kickass new Paypal scam

[ QUOTE ]
[ QUOTE ]
If it doesn’t start with HTTPS://WWW.PAYPAL.COM, it’s a scam.

Matt

[/ QUOTE ]
Actualy... the URL needs to end that way.
Most bogus URL's are things like (https://www.paypal.com.badguy.site.com/)
People see the beginning and think it's good... it's not.
It's what's at the end that counts.
It must end in paypal.com. Anything before it would be a sub-domain of paypal.com and would be legitimate.
All the phishers do is create a www.paypal.com sub-domain under their badguy.site.com parent domain to try and fool you.
Most people don't understand how the internet domain naming structure works, so it's easy to confuse the average surfer.

[/ QUOTE ]

No, that is not correct. Only PayPal will have a URL start with https://www.paypal.com/

This is Straight from PayPal:

[ QUOTE ]
Deceptive URLs. Only enter your PayPal password on PayPal pages. These begin with https://www.paypal.com/
If you see an @ sign in the middle of a URL, there's a good chance this is a spoof. Legitimate companies use a domain name (e.g. https://www.company.com).
Even if a URL contains the word "PayPal," it may not be a PayPal site. Examples of deceptive URLs include: www.paypalsecure.com, www.paypa1.com, www.secure-paypal.com, and www.paypalnet.com.
Always log in to PayPal by opening a new web browser and typing in the following: https://www.paypal.com/
Never log in to PayPal from a link in an email


[/ QUOTE ]

Here is where I got it. PayPal link Click on the "Read PayPal's 10 ways to recognize fake (spoof) emails now." In the middle of the page.

Matt

[Newc]

Re: Wow - kickass new Paypal scam

Also watch for the "S" at the end of "HTTP" - that denotes a secure site.

But yeah I have seen these and always go to the site directly from my Favorites or Address Bar - never through the email link.

[SeventhSon]

Re: Wow - kickass new Paypal scam

[ QUOTE ]

No, that is not correct. Only PayPal will have a URL start with https://www.paypal.com/


[/ QUOTE ]

True. But previous poster was saying that http://www.paypal.badguysite.com is a way to fool people who read the paypal notice into thinking it was a safe URL.

[rjohnstone]

Re: Wow - kickass new Paypal scam

Exactly... PayPal's info is a bit misleading... you can start the URL anyway you want if you own the parent DNS record.
it's what's between the https:// and the first / that counts.