Just had a classic virus attachment email:

We recently have determined that different computers have logged into your account, and multiple password failures were present before the login. Therefore your account has been limited.

Please download the form attached to this email and open it in a web browser.

Once opened, you will be provided with steps to restore your access.

We appreciate your understanding as we work to ensure account safety.

Copyright © 1999-2010 PayPal, Inc. All rights reserved.

PayPal Pty Limited ABN 93 111 195 389 (AFSL 304962). Any general financial product advice provided in this site has not taken into account your objectives, financial situations or needs.

[Attached of course, is a file “Profile Update – PayPal.mht (144KB)”, and an html email, likely infected too]

So how do I know so quickly it’s not real?

1. This is a classic threat of ‘act now or you’ll loose access to your account’, under the guise of your safety.
2. PayPal would not send attachments via email.
3. If there was an issue, at most, they’d ask me to visit the genuine PayPal.com website by going there directly, (ie not using a hidden link on the email) and then view something from there.
4. PayPal would not send programs to help your computer. That’s down to Microsoft, Apple, Linux, etc.
5. The email address this was sent to, was harvested from one of my websites, not the email address I use for PayPal.
6. The ‘To:’ field was empty within the message body (it should have my PayPal email only)
7. They did not use my full name, or my PayPal name in their message
8. The message layout doesn’t even contain the normal things PayPal send (although having them, does not make it genuine either, but at least not having them flags up more warnings)

For more information about greater safety with PayPal, please view the mail PayPal website:
https://www.paypal-marketing.co.uk/safetyadvice/safetytools.htm

And of course, don’t open anything or forward on anything, that is sent to you via email, apparently for ‘security’ or ‘safety’.  Virtually 100% of the time it’s a complete fake and will do more harm than good.

Just had this one through today, to an email address that’s only used by my web design clients (so unfortunately, some-one’s computer in that link is currently infected with a email harvesting virus):
—–  
From: PayPal [mailto:service@paypals.co.uk]  
Sent: 04 May 2009 19:07  
To: customer@paypal.co.uk
Subject: Receipt for Your Payment to Play and Connect Ltd  

Dear PayPal member, You sent a payment of £100.00 GBP to Play and Connect Ltd (fairyland@playandconnect.com) 

Issues with this transaction? Y

ou have 5 days from the date of the transaction to cancel it. If you haven’t authorized this charge ,click the link below to cancel transaction: https://www.paypal.com/cgi-bin/webscr?cmd=_login-run&dispatch=5885d80a13c0db1fa798f5a5f5ae4
[Link: http://paypal.co-uk.dt6.pl/?cmd=_login-run&dispatch=5885d80a13c0db1fa798f]

Please do not reply to this email. This mailbox is not monitored and you will not receive a response.

For assistance, log in to your PayPal account and click Help in the top right corner of any PayPal page.

To receive email notifications in plain text instead of HTML, log in to your PayPal account, go to your Profile, and click Notifications

Copyright ©1999-2009 PayPal. All rights reserved. PayPal (Europe) S.а r.l. & Cie, S.C.A. Sociйtй en Commandite par Actions Registered Office: 22-24 Boulevard Royal L-2449, Luxembourg RCS Luxembourg B 118 349 PayPal Email ID PP120
—–

This one did take me a few moments to recognise the phishing scam rather than the immediate recollection I normally have. So how did I know?

• The ‘To:’ field is customer@paypal.co.uk (rather than one of my actual paypal email addresses)
• It’s from a company I’ve never had any dealings with (normally a good warning sign) for a product I don’t recognise
• The ‘cancel transaction’ link, as I expected. If you hover over the link in the actual email (which claims to go through to PayPal.com), you’ll see it link up to the website http://paypal.co-uk.dt6.pl/

Because of the nature of the link, each of these emails will probably go through to a unique URL (web address), which flags up on their system you actively use that email, wrongly (which means far more junk mail and phishing scams coming through to you). Similarly of course, giving your full username and password on the page requested, will mean your account will be subsequently hacked pretty quickly, and you’ll loose money!

How can you prevent this type of phishing scam succeeding?

1. Never click on PayPal links in emails, to process any sort of transaction you’re notified about. Always type the PayPal.com web address directly into your browser window. (The same applies to banking emails, etc.)
2. Have unique email addresses for different purposes (ideally one per company you sign up to, etc. and have these all forwarding automatically through to a smaller selection of email addresses you can pick up easily).
3. If you do want to check the URL in an html type email.. normally just hover your mouse over the link (without clicking on it), and check the URL carefully. Normally phishing scams are sub-domains of sub-domains of random websites (ie http://paypal.com.something-random.zz/ljasdasDAlkjasdaalalsad… )
4. Upgrade to the most recent Internet Explorer 8, which highlights the actual domain name you’re on (or one of the others, like Mozilla, Chrome, Safari)
5. Keep your anti-virus (ie http://free.grisoft.com) up-to-date, and check regularly for malware, spyware, etc.
6. Never send bulk emails to the ‘To:’ or ‘Cc:’ field. Always use the ‘Bcc:’ field when sending group emails.

If you have any questions about any of the points raised above, please do contact us at Parlour Design.