Paypal users are being warned of a sophisticated phishing scam that tricks shoppers into handing over their access credentials and a range of other sensitive information.
The PayPal phishing scam begins by targeting users with an email warning which states that their account has experienced unusual activity and the recipient should act immediately to protect their financial information.
Although the email does not contain the obvious grammatical errors that you may expect from a phishing email, it does include other warning signs that the email is not from a legit sender. For example, the sense of urgency puts pressure on the recipient to act quickly which is often a common trait for phishing scams. Other telltale signs include the non-Paypal URL domain address and the use of a CAPTCHA which prevents a secure email gateway (SEG) from scanning the URL thereby enabling the threat to get through.
If the recipient clicks the embedded link on the “Secure My Account” button, they are then redirected to a PayPal branded website which has a valid SSL certificate to add a sense of legitimacy. For many, the presence of the green padlock to the left of the URL indicates that the user is on a secure website. However, in recent months countless phishing sites have been using authentic SSL (Secure Sockets Layer) certificates in order to boost their legitimacy.
A unique aspect of this scam is that the recipient is required to enter a captcha code which is often used to tell humans and computers apart. This is not a common trait of many phishing scams because it creates an extra step between users clicking the link and landing on the fraudulent page, but it does give the illusion that the page the victim is about to enter is secure.
Once they have submitted their PayPal credentials, the scam aims to extract even more information from the unknowing victim. In a series of steps, the recipient is then asked to declare personal information such as name, address, credit or debit card details and email login to validate the account.
When all these fields are completed and submitted, victims are then reassured that their account is finally secured. In reality, the victim has exposed several pieces of key personal and financial information that can be used by fraudsters to sell on the black market, commit identity theft or carry out credit card fraud.
For victims, even a brief lapse in judgment or a short moment of distraction can have far-reaching consequences. To stay safe, are a number of simple ways you can protect yourself from phishing attacks:
- Never click on links or download attachments from unknown sources.
- Always verify the security of a website.
- Hover your mouse over the links contained in emails to check if they are legitimate– don’t click unless you are sure they are safe.
- Pay close attention to the spelling of an email or web address, if there are any inconsistencies, delete immediately.
- Ignore and delete emails with poor grammar and formatting.
- Install the latest anti-virus software solutions on all your devices.
- Use strong passwords to reduce the chance of devices being hacked and use different passwords for different accounts.
- Question the validity of any email that asks you to submit personal or financial information.
Identifying a phishing email has become a lot harder than it used to be as criminals have become more advanced and deceptive in their attack methods. MetaPhish provides a powerful defence against phishing and ransomware attacks by training employees on how to identify and respond appropriately to these threats. Contact us for further information on how we can help protect your business.