PayPal hoax?

[king ubu]

Got the second of these messages today:

Dear valued PayPal® member:

PayPal® is committed to maintaining a safe environment for its community of

buyers and sellers. To protect the security of your account, PayPal employs

some of the most advanced security systems in the world and our anti-fraud

teams regularly screen the PayPal system for unusual activity.

Recently, our Account Review Team identified some unusual activity in your

account. In accordance with PayPal's User Agreement and to ensure that your

account has not been compromised, access to your account was limited. Your

account access will remain limited until this issue has been resolved. This

is a fraud prevention measure meant to ensure that your account is not

compromised.

In order to secure your account and quickly restore full access, we may

require some specific information from you for the following reason:

We would like to ensure that your account was not accessed by an

unauthorized third party. Because protecting the security of your account

is our primary concern, we have limited access to sensitive PayPal account

features. We understand that this may be an inconvenience but please

understand that this temporary limitation is for your protection.

Case ID Number: PP-040-187-541

We encourage you to log in and restore full access as soon as possible.

Should access to your account remain limited for an extended period of

time, it may result in further limitations on the use of your account.

However, failure to restore your records will result in account suspension.

Please update your records on or before May 29, 2005.

Once you have updated your account records, your PayPal session will not be

interrupted and will continue as normal.

To update your Paypal records click on the following link:

http://203.210.242.86/update/index.php

Thank you for your prompt attention to this matter. Please understand that

this is a security measure meant to help protect you and your account. We

apologize for any inconvenience.

Sincerely,

Joan

PayPal® Account Review Department

Of course I didn't click the link, and the email was not even addressed to me (other Flurin in the to-field, but same domain/mail-client, and my address probably hidden somewhere in the BCC... first mail had my address in the CC and the same other fellow in the TO).

What to do? Just delete it (as I did with the first, two or three days ago)? Or is there any address at PayPal where to direct this stuff?

My account, btw, is still working.

[EKE BBB]

Phishing?

I´ve received a lot of those damned messages from many "supposedly" banks: I´ve never had any account in any of them.

I recently read an interesting report written by Hispasec on phishing in Spanish banks: in most of the cases, the design of the web helps this kind of hoax practices

FUCK PHISHING!!!

[EKE BBB]

Flurin:

I´ve followed the link: it requires more or less the same information you need to provide when you open a new Paypal account, but regarding credit card information:

-it requires not only the Verification Number (as Paypal does) but also your Card PIN Number!!!

-it also requires your Bank Name, Bank Telephone Number, Routing Number (something that appears on your checks) and Bank Account Number !!!!!!!!

This is phishing, definitely.

Not sure if there´s a way to report Paypal what´s going on with this.

As for my bank, they have inserted a big message on the main page of their website, stating that THEY DON´T REQUIRE CONFIDENTIAL INFORMATION VIA E-MAIL.

When Paypal gets aware of this affair, they should do something similar.

FUCK PHISHING!!!!!

[king ubu]

Thanks Agustín!

I guess nothing to be afraid of then, just the usual attempts to get the cc info...

[J.A.W.]

I get these messages all the time. Don't click on ANY link, but report the message to spoof@eBay.com (PayPal is an eBay company nowadays) by forwarding it without a reply - i.e. don't type anything - and delete the message.

The same goes for all those phoney eBay e-mails requesting that you update your account.

Edited May 27, 2005 by J.A.W.

[king ubu]

Thanks Hans - will do so!

Of course I never click any of these links... I get this sort of spam mails all the time, but never with regard to PayPal before.

Couldn't quote your post, btw - I get error messages for every second of third click on the board

[Christiern]

J.A.W. has the right answer, but you must send the entire message to spoof@ebay.com, that means the header has to be there. On a Mac, you bring up the email in question and click on "Long Header"--then forward it to the spoof address. Without the full header, the abuse departments cannot trace the source and take action.

[king ubu]

J.A.W. has the right answer, but you must send the entire message to spoof@ebay.com, that means the header has to be there. On a Mac, you bring up the email in question and click on "Long Header"--then forward it to the spoof address. Without the full header, the abuse departments cannot trace the source and take action.

←

I sent it in and got a reply (pre-fab one, I assume). The header was "FW: [orig. header]" - hope that helped.

[WD45]

I get these messages all the time. Don't click on ANY link, but report the message to spoof@eBay.com (PayPal is an eBay company nowadays) by forwarding it without a reply - i.e. don't type anything - and delete the message.

The same goes for all those phoney eBay e-mails requesting that you update your account.

←

This is the way to go.

I always go into my paypal account via typing it myself whenever I get one of these emails. Never is anything wrong.

[couw]

J.A.W. has the right answer, but you must send the entire message to spoof@ebay.com, that means the header has to be there. On a Mac, you bring up the email in question and click on "Long Header"--then forward it to the spoof address. Without the full header, the abuse departments cannot trace the source and take action.

←

I sent it in and got a reply (pre-fab one, I assume). The header was "FW: [orig. header]" - hope that helped.

←

nope. Here's an explanation of what Chris meant:

http://cf.stanford.edu/doc/email/headers.php

[Man with the Golden Arm]

anyone know how much time a buyer has to cancell a transfer of funds?

just this week a guy at my studio here just sold a mountain bike fork to a stateside buyer. after receivng payment of $500 plus via PayPal and then confirmed to the inquisitive buyer that the item was infact shipped yesterday, PayPal actually phoned him this morning to let him know that the payment had been cancelled. i'm not sure whether he's able to track this as i think the buyer was letting him know that it was not necessary. turns out it was a European base for the payment and not a stateside account. this deal was off eBay thru a bike nerd site. he'd already had a half a dozen ruses prior but this one snagged him.

seems to me that these tricks might undermine the trust of PayPal and old time establishments like Western Union would be wise to start a bit of negative advertising to lure away some lost business from the greedy start-up.

[king ubu]

J.A.W. has the right answer, but you must send the entire message to spoof@ebay.com, that means the header has to be there. On a Mac, you bring up the email in question and click on "Long Header"--then forward it to the spoof address. Without the full header, the abuse departments cannot trace the source and take action.

←

I sent it in and got a reply (pre-fab one, I assume). The header was "FW: [orig. header]" - hope that helped.

←

nope. Here's an explanation of what Chris meant:

http://cf.stanford.edu/doc/email/headers.php

←

Uhm, this is getting complicated... I was just using the web-client anyway, no idea how to this stuff there. Next time I'll wait till I have the mail on my own computer and then I'll ask couw again to send me that link

[J.A.W.]

anyone know how much time a buyer has to cancell a transfer of funds? 

just this week a guy at my studio here just sold a mountain bike fork to a stateside buyer.  after receivng payment of $500 plus via PayPal and then confirmed to the inquisitive buyer that the item was infact shipped yesterday, PayPal actually phoned him this morning to let him know that the payment had been cancelled.  i'm not sure whether he's able to track this as i think the buyer was letting him know that it was not necessary.  turns out it was a European base for the payment and not a stateside account.  this deal was off eBay thru a bike nerd site.  he'd already had a half a dozen ruses prior but this one snagged him.

seems to me that these tricks might undermine the trust of PayPal and old time establishments like Western Union would be wise to start a bit of negative advertising to lure away some lost business from the greedy start-up.

←

I don't quite understand - once a PayPal payment has been completed it can't be cancelled. A seller should never ship anything as long as the payment has not been completed.

Once a payment has been completed the only thing a buyer can do if he has doubts is file a claim with PayPal and ask them for a refund. PayPal will then look into the matter and contact the seller; they will only grant the claim if it is founded according to their rules.

Edited May 27, 2005 by J.A.W.

[Man with the Golden Arm]

anyone know how much time a buyer has to cancell a transfer of funds? 

just this week a guy at my studio here just sold a mountain bike fork to a stateside buyer.  after receivng payment of $500 plus via PayPal and then confirmed to the inquisitive buyer that the item was infact shipped yesterday, PayPal actually phoned him this morning to let him know that the payment had been cancelled.  i'm not sure whether he's able to track this as i think the buyer was letting him know that it was not necessary.  turns out it was a European base for the payment and not a stateside account.  this deal was off eBay thru a bike nerd site.  he'd already had a half a dozen ruses prior but this one snagged him.

seems to me that these tricks might undermine the trust of PayPal and old time establishments like Western Union would be wise to start a bit of negative advertising to lure away some lost business from the greedy start-up.

←

I don't quite understand - once a PayPal payment has been completed it can't be cancelled. A seller should never ship anything as long as the payment has not been completed.

Once a payment has been completed the only thing a buyer can do if he has doubts is file a claim with PayPal and ask them for a refund. PayPal will then look into the matter and contact the seller; they will only grant the claim if it is founded according to their rules.

←

that's what i presumed as well.

i had a buyer cancel on me once but i had not yet sent the parcel so i got lucky.

maybe the buyer had the original source of funds revoke the transaction from PayPal?

i will get the skinny as to what PayPal claimed on this from the man himself in a bit as he is evidently out of his mind trying to head the fork off at the pass.

[king ubu]

I just had a closer look at the reply I got from PayPal - the reply included my (forwarded as attachement) original message, and this is what stood at the begin not of my message, but of the forwarded hoax message in the PayPal reply:

--========/4262fed50011e6b6/mssazhh-int.msg.bluewin.ch

content-type: message/rfc822

content-disposition: inline

received: from mx25.bluewin.ch (*******) by

mssazhh-int.msg.bluewin.ch (bluewin 7.0.035) id 42794b99015a402b

for ****@bluewin.ch; thu, 26 may 2005 20:36:25 +0000

received: from cpc4-john2-4-0-cust86.renf.cable.ntl.com (*****) by

mx25.bluewin.ch (bluewin 7.2.059) id 426908830195246d; thu, 26

may 2005 20:36:25 +0000

received: from urbane.paranoid

(chortle03103824waterway.bloodshed.footwear.comcast.net) by

mtflood05.culprit.net (iplanet messaging server 5.8 hotfix 1.09) with

smtp id <0h9p00e0nih7aa@mtaout05.icomcast.net> for

mpsekmshcdweza@yahoo.com; fri, 27 may 2005 14:29:22 +0100

date: fri, 27 may 2005 15:35:22 +0200

from: "joan@paypal.com" <mpsekmshcdweza@yahoo.com>

to: *****@bluewin.ch

subject: please resolve your paypal account

x-mailer: ximian evolution 1.0.8

message-id: <2.20020816120021.01316ampsekmshcdweza@yahoo.com>

mime-version: 1.0

content-transfer-encoding: quoted-printable

x-mime-autoconverted: from 8bit to quoted-printable by

mailhost3.sjc.ebay.com id j4rbc36a020685

The stars are mine - I don't know if that was all the sensitive content of the stuff above, if not tell me what else should not be put up here on the web.

As I said, the @bluewin.ch address was not mine, but some other Flurin's - I can't see any info actually concerning my mail-address above.

But the main question: does this above include what you call the "header" (and I mistook for "subject") of the mail?

EDIT: saw my address, added some *** there, too

Edited May 27, 2005 by king ubu

[J.A.W.]

i had a buyer cancel on me once but i had not yet sent the parcel so i got lucky. 

maybe the buyer had the original source of funds revoke the transaction from PayPal?

Had the payment been completed yet? If yes, this is very strange. Didn't PayPal give a reason/explanation? Besides, it usually takes quite some time (days rather than hours) before the original source of funds will revoke the transaction.

Edited May 27, 2005 by J.A.W.

[Man with the Golden Arm]

anyone know how much time a buyer has to cancell a transfer of funds? 

just this week a guy at my studio here just sold a mountain bike fork to a stateside buyer.  after receivng payment of $500 plus via PayPal and then confirmed to the inquisitive buyer that the item was infact shipped yesterday, PayPal actually phoned him this morning to let him know that the payment had been cancelled.  i'm not sure whether he's able to track this as i think the buyer was letting him know that it was not necessary.  turns out it was a European base for the payment and not a stateside account.  this deal was off eBay thru a bike nerd site.  he'd already had a half a dozen ruses prior but this one snagged him.

seems to me that these tricks might undermine the trust of PayPal and old time establishments like Western Union would be wise to start a bit of negative advertising to lure away some lost business from the greedy start-up.

←

I don't quite understand - once a PayPal payment has been completed it can't be cancelled. A seller should never ship anything as long as the payment has not been completed.

Once a payment has been completed the only thing a buyer can do if he has doubts is file a claim with PayPal and ask them for a refund. PayPal will then look into the matter and contact the seller; they will only grant the claim if it is founded according to their rules.

←

that's what i presumed as well.

i had a buyer cancel on me once but i had not yet sent the parcel so i got lucky.

maybe the buyer had the original source of funds revoke the transaction from PayPal?

i will get the skinny as to what PayPal claimed on this from the man himself in a bit as he is evidently out of his mind trying to head the fork off at the pass.

←

as for my snafoo it was cancelled almost immediately as i had checked more than i would have normally.

now as far as the guy with the bike fork:

he received a mail yesterday saying he had cash. addressed from the payor and upon checking his payPal account he saw a balance reflecting that $500 payment. he went to the USPS and sent a $500 item with NO TRACKING NUMBER WTF!!!! just being thrifty. he then returned and transfered the funds to his regular bank account.

then he received an email from PayPal stating that his transfer had ben reveresed and the he was the recipient of "unauthorized" funds. now he is out the $500 and the fork is on the way to some kid from Bulgaria's uncle in Illinois who will ship it to him after he get's it.

Now! if he received a notice that he "got cash" from an actual PayPal isp and then sees that balance in his account I believe PayPal is culpable for the fact that he was on the up and up and shipped the item immediately.

something to be said for a bit of procrastination and something more to be said for UPS and tracking numbers for stuff more than a few bills.

[BERIGAN]

Did you get a response from Ebay yet? They usually send automated emails right back to you saying they will work on it, then one saying that it was a spoof. Since this was a paypal email though, it would probably be better to forward it to spoof@paypal.com

They keep trying to make them seem more like legit emails all the time, but the spoofers never have your handle on ebay or your name. Well should say almost never, one did have my name, but that has happened only once in about 500 fake emails....

Has anyone said on this thread....

FUCK PHISHING!!!!!

Edited May 27, 2005 by BERIGAN

[J.A.W.]

anyone know how much time a buyer has to cancell a transfer of funds? 

just this week a guy at my studio here just sold a mountain bike fork to a stateside buyer.  after receivng payment of $500 plus via PayPal and then confirmed to the inquisitive buyer that the item was infact shipped yesterday, PayPal actually phoned him this morning to let him know that the payment had been cancelled.  i'm not sure whether he's able to track this as i think the buyer was letting him know that it was not necessary.  turns out it was a European base for the payment and not a stateside account.  this deal was off eBay thru a bike nerd site.  he'd already had a half a dozen ruses prior but this one snagged him.

seems to me that these tricks might undermine the trust of PayPal and old time establishments like Western Union would be wise to start a bit of negative advertising to lure away some lost business from the greedy start-up.

←

I don't quite understand - once a PayPal payment has been completed it can't be cancelled. A seller should never ship anything as long as the payment has not been completed.

Once a payment has been completed the only thing a buyer can do if he has doubts is file a claim with PayPal and ask them for a refund. PayPal will then look into the matter and contact the seller; they will only grant the claim if it is founded according to their rules.

←

that's what i presumed as well.

i had a buyer cancel on me once but i had not yet sent the parcel so i got lucky.

maybe the buyer had the original source of funds revoke the transaction from PayPal?

i will get the skinny as to what PayPal claimed on this from the man himself in a bit as he is evidently out of his mind trying to head the fork off at the pass.

←

as for my snafoo it was cancelled almost immediately as i had checked more than i would have normally.

now as far as the guy with the bike fork:

he received a mail yesterday saying he had cash. addressed from the payor and upon checking his payPal account he saw a balance reflecting that $500 payment. he went to the USPS and sent a $500 item with NO TRACKING NUMBER WTF!!!! just being thrifty. he then returned and transfered the funds to his regular bank account.

then he received an email from PayPal stating that his transfer had ben reveresed and the he was the recipient of "unauthorized" funds. now he is out the $500 and the fork is on the way to some kid from Bulgaria's uncle in Illinois who will ship it to him after he get's it.

Now! if he received a notice that he "got cash" from an actual PayPal isp and then sees that balance in his account I believe PayPal is culpable for the fact that he was on the up and up and shipped the item immediately.

So, if I understand this correctly, the cancelled PayPal payment was made by someone other than the actual buyer of the item. Maybe that's the problem. Why doesn't the seller contact PayPal and ask them for (more) details and also tell them that he holds them responsible and file a claim?

[J.A.W.]

anyone know how much time a buyer has to cancell a transfer of funds? 

just this week a guy at my studio here just sold a mountain bike fork to a stateside buyer.  after receivng payment of $500 plus via PayPal and then confirmed to the inquisitive buyer that the item was infact shipped yesterday, PayPal actually phoned him this morning to let him know that the payment had been cancelled.  i'm not sure whether he's able to track this as i think the buyer was letting him know that it was not necessary.  turns out it was a European base for the payment and not a stateside account.  this deal was off eBay thru a bike nerd site.  he'd already had a half a dozen ruses prior but this one snagged him.

seems to me that these tricks might undermine the trust of PayPal and old time establishments like Western Union would be wise to start a bit of negative advertising to lure away some lost business from the greedy start-up.

←

I don't quite understand - once a PayPal payment has been completed it can't be cancelled. A seller should never ship anything as long as the payment has not been completed.

Once a payment has been completed the only thing a buyer can do if he has doubts is file a claim with PayPal and ask them for a refund. PayPal will then look into the matter and contact the seller; they will only grant the claim if it is founded according to their rules.

←

that's what i presumed as well.

i had a buyer cancel on me once but i had not yet sent the parcel so i got lucky.

maybe the buyer had the original source of funds revoke the transaction from PayPal?

i will get the skinny as to what PayPal claimed on this from the man himself in a bit as he is evidently out of his mind trying to head the fork off at the pass.

←

as for my snafoo it was cancelled almost immediately as i had checked more than i would have normally.

now as far as the guy with the bike fork:

he received a mail yesterday saying he had cash. addressed from the payor and upon checking his payPal account he saw a balance reflecting that $500 payment. he went to the USPS and sent a $500 item with NO TRACKING NUMBER WTF!!!! just being thrifty. he then returned and transfered the funds to his regular bank account.

then he received an email from PayPal stating that his transfer had ben reveresed and the he was the recipient of "unauthorized" funds. now he is out the $500 and the fork is on the way to some kid from Bulgaria's uncle in Illinois who will ship it to him after he get's it.

Now! if he received a notice that he "got cash" from an actual PayPal isp and then sees that balance in his account I believe PayPal is culpable for the fact that he was on the up and up and shipped the item immediately.

So, if I understand this correctly, the cancelled PayPal payment was made by someone other than the actual buyer of the item. Maybe that's the problem. Why doesn't the seller contact PayPal and ask them for (more) details and also tell them that he holds them responsible and file a claim?

←

This is what I found on the PayPal site about cancelling payments by the buyer:

Tracking Payments - Cancelling a Payment

Q: Can I cancel a payment that I've already sent?

A: You can cancel only unclaimed payments. If your payment is complete, please contact the recipient of the payment directly to request a refund.

Unclaimed payments may be canceled for the following reasons:

A payment sent to an email address that is not associated with a PayPal account. Once the email address is added to a PayPal account, the payment will be automatically credited to the balance of that account.

A payment has been sent to a recipient with an unconfirmed email address. For security reasons, PayPal can only credit payments sent to a confirmed email address.

If you cancel an Instant Transfer, PayPal cannot cancel the withdrawal from your bank account. The amount will be credited to your PayPal account balance.

Here's How:

Click the My Account tab.

Click the History subtab.

Click Cancel in the Action column of the transaction in question.

Click Cancel Payment.

You have successfully canceled the payment.

(edit/my addition: the "cancel" option doesn't show up with claimed/confirmed payments)

Edited May 27, 2005 by J.A.W.

[J.A.W.]

Sorry for hijacking your thread, Flurin.

[Man with the Golden Arm]

me too, i thnk is see "cubu" just ahead ... geronimoooooooo!

[mikeweil]

Besides phishing, some of these hoaxes include tojans or backdoor programs - I recently received one with a faked online phone bill (a .zip file which revealed a double file signature .pfd.exe when unpacked - only if you clicked the unpacked it downloaded another backdoor program).

For German speaking members there is great info on a website of TU Berlin:

http://www.hoax-info.de

BTW that PayPal hoax is on the list on this page:

http://www.tu-berlin.de/www/software/hoax/idtheft.shtml

Edited May 27, 2005 by mikeweil

[Brad]

I don't even open them, just delete them. They're all hoaxes.

[BERIGAN]

I don't even open them, just delete them.  They're all hoaxes.

←

I do think we should at least forward them to spoof@ebay.com or spoof@paypal.com as soon as we get them so they can at least shut the folks down(for an hour or two at least) before they get some old person who just signed up with paypal or whatever and think it is a legit request......