MailGuard has intercepted a phishing email scam impersonating global online payments system, PayPal. The scam was first detected on Thursday 19th September around midday (AEST).
Recipients are prompted to review their PayPal account information after being told that their account is 'out of compliance' with PayPal's regulatory requirements.
The email uses the display name 'PayPal' and exploits newsletter.com.au as the email appears to be delivered via the newsletter service.
A sense of urgency is created in its statement that "this request will be available for 24 hours", encouraging the recipient to click on the 'Check it now' button without thinking twice.
Below is a screenshot of the email:
Recipients who click on the 'Check it now' button within the email are directed to a fake PayPal phishing page that has been designed to steal their login credentials.
Below is a screenshot of the phishing page:
After providing login credentials to the phishing page and hitting the 'Next' button, recipients are taken to the genuine PayPal home page.
While this email is simple in its design, cybercriminals have employed several techniques to make it look like a genuine notification from PayPal - including incorporating the company's branding and logo.
Many of us rely on PayPal as a trusted means of making and receiving payments securely, so naturally, when we receive an email supposedly from PayPal regarding an action required for our account, we would take action.
However, eagle-eyed recipients would notice several red-flags that point to the email's illegitimacy. These include grammatical errors such as "take a moment to review your account's informations."
MailGuard urges email users to remember that cybercriminals prey on the brands that we trust and love, like PayPal, and to always think twice before clicking on any type of link or attachment within an email if they’re uncertain of its legitimacy.
To protect your business against scams like this PayPal phishing email:
- Beware of emails that contain grammatical or branding errors, but purport to be from reputable organisations.
- Always hover your mouse over the links contained in emails in order to check their legitimacy – don’t click them unless you are sure they are safe.
- To ensure safety, type the URL of the organisation you are intending to visit manually into your browser or navigate through Google search to find the correct website before entering your credentials.
- Be particularly wary of emails asking you to supply personal details that the purported organisation should already know, especially those which ask for credit card or bank account details.
If you are unsure if a PayPal email is legitimate, simply contact the company directly.
MailGuard urges all recipients of this email to delete it immediately without clicking on any links.
One email
Cybercriminals use email scams to infiltrate organisations with malware and attack them from the inside. All criminals need to break into your business is a cleverly-worded message. If they can trick one person in your company into clicking on a malicious link they can gain access to your data.
For a few dollars per staff member per month, you can protect your business with MailGuard's predictive and advanced email security.
Talk to a solution consultant at MailGuard today about securing your company's network.
Why not stay up-to-date with MailGuard's latest blog posts by subscribing to free updates? Subscribe to weekly updates by clicking on the button below.
