Paypal question

[Jeff396]

Hi,

I just got an email saying that an additional email address, that I don't recognize, was added to my paypal account. It looks official but seems bogus to me. I was wondering if anyone else has recieved this message? A while back I got an email saying that my payment to so and so was processed through paypal and of course it wasn't. Is this the same scam hoping I will click on the link that is in the message?

Jeff

 

[Gatorboy]

I suggest going to Paypal yourself and checking your account.

Sounds like this is a scam to get you to hit the LINK in the email which most likely will look like the "official" paypal site, and prompt you for your username/password.

 

[rozett]

If you don't recognize the email address, then I would notify PayPal immediately and not allow any transactions. If possible, I would call them and talk to a live person. There are just too many opportunities to get screwed with PP and I wouldn't take a chance.

 

[btolle]

</font><font color="blue" class="small">( If you don't recognize the email address, then I would notify PayPal immediately)</font>

I will go further than that: Do NOT ever respond to any of these messages from PayPal, Ebay, or any financial institution. They are all scams. I get various messages like that a couple of times a month and always forward them to the appropriate company so their fraud departments can pursue them.

There is a warning about this particular scam at Paypal - 'New email address added to your account'

Bill Tolle

 

[Jeff396]

Yep, that is exactly the one I got. I immediately went to Paypal and logged on in my normal way and did not find a new email address on my account but it still made me nervous. Thanks for the link!! I'll rest easier now. /forums/images/graemlins/crazy.gif

Jeff

 

[jwnge]

If I'm not mistaken, PayPal always uses your name when they contact you, Most scams don't know your name. these thieves are getting smarter all the time, so be careful with any transaction /forums/images/graemlins/mad.gif ...John

 

[Tractors4u]

You should be able to configure your e-mail to give a detailed address of the person who sends you an e-mail. For example, I use Hotmail for most of my e-mailing. These scammers will cloak their real e-mail address with something that looks legit. Typically if I receive something from Paypal the address may read something like, security@paypal.com. If I see something suspicious I can set my preferences so that it will show more details and I have caught some that were actually more like scammer@yahoo.uk.

 

[PineRidge]

It's a scam I get the same email every couple of days. They want control of our eBay & PayPal account real bad. Probably want to sell some bogus tractors.... /forums/images/graemlins/wink.gif

 

[OkeeDon]

Right click the email and click "View Source" (almost all of the scam messages that want you to click a link are formatted in html). Notepad will open up on your computer with a bunch of gobbledegook (if you know html you will recognize it). Scroll down until you see some plain text that looks like the text close to the link in the Email. Look for a tag (the things that start with "<" and end with ">" that says, "a href" inside it. That's the beginning of a link, in this case supposedly a link to PayPal. You will see the REAL link, where it is going, not the PayPal site. Further along, you will see some text that looks like the link you saw in your Email -- that's the FAKE link, the one where you think it is going. The real link may be in text, with the usual "http://www.somelink.ext", or it may be the actual numerical link, like "http://200.100.000.000" You can usually enter that link safely and see where it takes you, providing you don't enter any information. If you're concerned, go visit your worst "friend" and do it from his computer when he's not looking (just kidding). The last one I tried took me to a sub-domain on a web site owned by a university in Korea. The university probably had no idea the sub-domain had been created and was being used in that manner.

 

[Jeff396]

I already deleted the message but I will give that a try on the next one I get. Fortunately, I haven't gotten too many of these which I guess makes it worse when you're not used to seeing them. Thanks for the info!

Jeff

 

[PineRidge]

They hope folks panic, follow their link, and spill their private info.....

 

[aardvark]

Next time you get the Paypal phishing emails, just forward it to spoof@paypal.com, along with the header text copied into the email body. These emails are scams, as everyone else has stated.

 

[PineRidge]

This is another variation of the scheme that we receive almost daily. It's still jive.



Dear (email address hidden),

Recently, our Account Review Team identified some unusual activity in your account. In accordance with PayPal's User Agreement and to ensure that your account has not been compromised, access to your account was limited. Your account access will remain limited until this issue has been resolved. This is a fraud prevention measure meant to ensure that your account is not compromised.

Case ID Number: PP-046-631-789
We encourage you to log in and restore full access as soon as possible.Should access to your account remain limited for an extended period of time, it may result in further limitations on the use of your account or may result in eventual account closure.


Thank you for your prompt attention to this matter. Please understand that this is a security measure meant to help protect you and your account. We apologize for any inconvenience.

To keep your account active, login on our SSL secure server:

http://210.222.212.229/.p/online.paypal.com/webscr/paypal_login-run/SSLsecure/index.php?redir=_rav-form

Sincerely,
PayPal Account Review Department

 

[OkeeDon]

Here's the IP info for that url:
------------------------
<font color="red"> [whois.apnic.net node-2]
% Whois data copyright terms http://www.apnic.net/db/dbcopyright.html

inetnum: 210.220.128.0 - 210.223.255.255
netname: KRNIC-KR
descr: KRNIC
descr: Korea Network Information Center
country: KR
admin-c: HM127-AP
tech-c: HM127-AP
remarks: ******************************************
remarks: KRNIC is the National Internet Registry
remarks: in Korea under APNIC. If you would like to
remarks: find assignment information in detail
remarks: please refer to the KRNIC Whois DB
remarks: http://whois.nic.or.kr/english/index.html
remarks: ******************************************
mnt-by: APNIC-HM
mnt-lower: MNT-KRNIC-AP
changed: seungmin@nic.or.kr 19991112
changed: hostmaster@apnic.net 20010606
status: ALLOCATED PORTABLE
changed: hm-changed@apnic.net 20030411
source: APNIC

person: Host Master
address: 11F, KTF B/D, 1321-11, Seocho2-Dong, Seocho-Gu,
address: Seoul, Korea, 137-857
country: KR
phone: +82-2-2186-4500
fax-no: +82-2-2186-4496
e-mail: hostmaster@nic.or.kr
nic-hdl: HM127-AP
mnt-by: MNT-KRNIC-AP
changed: hostmaster@nic.or.kr 20020507
source: APNIC
</font>