A brazen new PayPal phishing email attempts to steal a range of private information including ATM pins and credit card details.
The email looks relatively sophisticated at a glance, but has some obvious hallmark of a scam: grammatical errors, awkward sentence structures and oddly-capitalised letters.
By clicking a ‘Confirm my account’, users are directed to a fake PayPal log-in page.
The scam attempts to hide the actual phishing site you are visiting by encoding the entire page into the URL field of the browser. While “security.paypal.com” is part of the URL, it bears no relationship to the real PayPal page.
However, once there, victims are informed their account can’t be loaded.
They’re presented with another link, which leads to a page asking for their PayPal details – including date of birth, address and phone number.
After hitting continue they’re asked to add their credit card information, including expiry date and CSC. The error-ridden page heading: “Confirm your card for shop with PayPal right away” is another giveaway that this isn’t a professional communication sent by PayPal.
Next, the phishing scammers get even more brazen. Advising users to ‘Confirm your bank account’, they request details including bank name, account number, password and even ATM pin.
Having successfully gathered a huge range of personal and financial information, the cybercriminals advise that the account has been successfully updated, and is now ready for use.
No stranger to hoax emails, PayPal offers security advice for people who suspect they’ve received a scam email. PayPal’s tips include these warning signs:
- Generic greetings, like “Dear user”
- False links. Hover over a link or tap and hold it on a mobile device to see its destination
- Wrong, out of date or out of place logos or design
- Upsetting or urgent statements demanding you react immediately
- Bad spelling and grammar
- Requests for financial or personal information
For a few dollars per staff member per month, add MailGuard's cloud-based email and web filtering solution to your business security. You’ll significantly reduce the risk of new variants of malicious email from entering your network.
Our benchmarking shows that MailGuard is consistently 2-48 hours ahead of the market in preventing new attacks.
Find more tips on identifying email scams by subscribing to MailGuard’s blog.
Keep up to date on the latest email scams by subscribing to MailGuard’s weekly update or follow us on social media.
