Shoutbox

quote:

---

Originally posted by Gin
Hi again. It did turn out to be a scam in the end... I contacted my bank and they advised that the best thing was to to close my account and open a new one - so I have a new account number card number etc now. Thanks for all the replies.

Adeptus, looking at the link you gave I think this is what I was sent. Certainly seems to describe it.

Today I have received another "paypal" email... although I am being far more cautious this time around. Lol. This one even sounds suspicious to me. And the address it is sent from is not service@paypal.co.uk  as they usually are, but from the address service@bank.pay-pal.com

What I found strange about this one today is it's content;


It's weird considering I have done this, but I don't think it's real as I have logged onto my paypal account and had no problems doing so, and found nothing saying I need to fill in information.

---

PAY-PAL.COM IS NOT THE SAME AS PAYPAL.COM

Never EVER click on links of which the URL does not begin with the official host of the company the mail is from (or claims to be).

And by URL I mean the actual link, not the stuff you'll see in the mail itself.

The only way to see the true URL is by looking at your statusbar in your email client (or browser). What is displayed in the text can be whatever they wanted it to be...

eg: look at this link. Nothing suspicious right? Take a look again and this time hoover your mouse over the link and look at your status bar.

http://www.msgplus.net/

So, this is a very important reason why you should always have status bar visible (may sound stupid but I know many people who fail to see the use of them... well here you go )!

-------

Thus I'm very sure that this https://www.paypal.com/cgi-bin/webscr/?cmd=_login-run-secure link was the think you saw in the mail, but what was the actual URL? I very highly doubt it was that same link...

-------

Also, email addresses themself say absolutely nothing. Except that official sites will always use offcial emails, but then again, so will sites and people who want to steal from you..

quote:

---

Originally posted by CookieRevised
The only way to see the true URL is by looking at your statusbar in your email client (or browser). What is displayed in the text can be whatever they wanted it to be...

---

Even that is not fool-proof. Statusbar text can easily be changed in various browsers with some scripting. The location bar at the top of your browser is safer for that matter. The downside is that you have to click the link first, but once you clicked you'll have the true location in your location bar. But even then you should watch out:

http://www.paypal.com.accountinfo.login.evilspoof...ite.cx/stealmoney/

That site begins with paypal.com and looks safe when your browser only shows the first part of the URL.... but when you scroll to the part at the end you'll see it's actually a subdomain on evilspoofingsite.cx.

yeah... true... (but you can have some control over that: eg: never enable scripting for emails...there is no use for it either actually)

so, indeed the truely only way would be to right click a link (provided that isn't your shortcut to open the link in a new window or whatever) and choose properties to see the actual URL (or script command) behind the link.

Gin,

You simply need to get in the habit of deleting all such unsolicited emails without even reading them.  Even if they were from Paypal, they probably would be advertising you can live without. 

To give you an idea how bad it can get, I receve 6 or more fake "Paypal" and various bank emails at one of my older email addresses, each day.

The only exception would be if you did something on Paypal or bank website and were explicitly told they will email you a confirmation with a link to click.  In that case, you should check for it right away and do it.

If you still read some unexpected email and feel concerned about it, just go to the site using your existing bookmark or typing in the address as you normally would.  If there is a real issue with your account, you should receive some notice about that after you log in.

P.S. Do not -- I repeat, do not -- rely on any suggestions on how to distinguish "good" emails from the "bad" ones.  While someone with a strong technical / security background may be able to do so by simple inspection, there are too many tricks to be aware of for a typical user -- and the list keeps growing.  False sense of security is a very bad thing.