New "PayPal" phishing scam

[MOCAŠ]

New to me, anyway. Received this email yesterday morning:

Hello Member,​

You sent a payment of 50.00 GBP to ebay.co.uk - E Bay, Inc.
This charge will appear on your credit card statement as payment to PAYPAL *EBAYUK.​

Merchant information
Ebay.co.uk - E Bay
[email protected]

Instructions to merchant
None provided​

Description

Unit price
Qty​

Apple MAC G5 Dual 2.0 Ghz Parts
Item : #214

50.00 GBP
1​

Receipt No: 3324-6412-5127-2104
Please keep this receipt number for future reference. You'll need it if you contact customer service at e-shop, Inc. or PayPal.

Do you confirm this payment?​

If this payment was not made by you please immediately take the following steps:

* Login to your account by clicking on the link below :
* Provide requested information to ensure you are the owner of the account
* Find this transaction in HISTORY and click 'Cancel Transaction'

CANCEL TRANSACTION!



Thanks for using PayPal – the safer, easier way to pay and get paid online.
Please do not reply to this email. This mailbox is not monitored and you will not receive a response.

Now, I knew I hadn't spent £50 on Mac parts, but there were enough alarm bells to stop me clicking on the link in the email.

a) There's no mention of my PayPal/eBay user name.
b) I've never had a confirmation email from them before.
c) The sender's address was shown as [email protected], and PPL are nothing to do with PayPal.
d) I tend not to click on email links to login pages anyway.

So I'm guessing the idea is that I click on the "Cancel Transaction" link (which I've disabled in this post) and it takes me to PayPal lookalike site that captures my login details. Hmm. The link actually points to almejharnews.com, which is known to phishtank.com.

Just in case anyone else might get caught out by this.

 

[A1GSS]

Good call, I think. Looks dodgy, I use Paypal and eBay a fair bit and never seen this. I'd suggest that you report this to PayPal and to eBay immediately. My experience is that they react very fast to this kind of thing.

 

[johny5_uk]

I like to hover over the link that the scammed wants you to click.
Right click then copy the address.
Open up a new browser window and paste the link into the address bar (sometimes the scammers have embedded your email address into the link and use this as a check to see if your email address is live, if this is the case then change it to a bogus one like [email protected]).
Then if you are presented with lots of check boxes set to collate your private info, remember this is not real, so fill in as many insults and fake addresses as you like.

One major thing I need to point out is that I do this in a controlled environment so as to not have my pc infected by anything that the bogus site may throw at me or try and make me install.
It's a small step for satisfaction, I don't do this all the time but it brings relief once in a while to know mr Agedegwengo is trying to rape a bank account or credit card made from lots of 9's and also using names like Ivor Bigun.

 

[EDZ649]

Looks like a fake to me. Just forward it on to [email protected] and they will confirm.

 

[Stratman]

Well spotted.

I'm sure Paypal will be interested. They don't want other scammers muscling in on their turf.

 

[A1GSS]

Well spotted.

I'm sure Paypal will be interested. They don't want other scammers muscling in on their turf.

Paypal is legit.

 

[Druk]

Whoooosh.

 

[SilverSaloon]

As a general rule, ebay and paypal will atleast start their emails with "Dear <user id> or your actual name. not some obvious name taken from your email, ie "Dear DPAYNE", etc. Anything that says "Dear User", "Dear Member" etc are generally dodgy. My hotmail account is full of spam of this nature.

anything paypal, ebay related that you dont recognise, just go direct to the site in question and if its genuine it will be there.

 

[Chris Akabusi]

If i have an email from eBay or Paypal, or my bank for that matter, i tend to close the email (never click on the links in the email) and then log into eBay/Paypal through there actual sites, rather than going through the link.