I just recently received this in my inbox, and although it isn't addressed to me by 'name' I clicked the link, (and no I didn't enter any info); ".....Account System Cleanup IMPORTANT Dear PayPal Member, Due to overwhelming reports of fraudulent transactions and account abuse, PayPal now requires all active members who have an account to verify that they rightfully own it. You must click the link below and enter your email, password and reference code on the following page to verify your account. This is NOT a SCAM or HOAX. Please check your address bar to make sure you are on the authentic PayPal website. https://www.paypal.com/accountcleanup/ Your reference code is : XXX-XXXX-XXXX You will be guided through a series of steps which will require you to enter personal information, such as credit card number and/or bank details. ALL accounts not re-verified within 5 days of receiving this email will be automatically frozen. PayPal is doing this to protect it's valued members from fraud and scams. Paypal will not share your personal information with other companies and corporations. Privacy Policy Thank you for your co-operation, PayPal Please do not reply to this e-mail. Mail sent to this address cannot be answered. Due to security reasons your name and personal information cannot be mentioned in this email. To receive email notifications in plain text instead of HTML, update your preferences here. Protect Your Account Info A genuine PayPal link will always begins with "http://www.paypal.com" Remember to check your browser's Address/URL Bar to be sure you are on an authentic PayPal site. Please make sure the link you click on starts with "https://www.paypal.com" Paypal will never ask for sensitive information. PayPal sites that ask for Passport information, Driver's licence details are definitely scams. For more information on protecting yourself from fraud, please visit the Security Center. Protect Your Password You should never give your PayPal password to anyone, including PayPal employees....." Now it also didn't have the usual Paypal email id at the bottom. But after clicking the link to see what's what, it goes to what looks like the real Paypal site,little padlock and all, I clicked every link you don't need to sign in for and they went to pages that I verified later as a paypal page...I also forwarded it the spoof@paypal.com. Has anyone else rec'd one of these? the scammers are getting very good at stealing Paypal's site pages and duping the site, down to the 'contact us' page with FAQ etc...

I didn't get anything like this, and I use PayPal frequently. I went to the site just now and don't see any request for me to log in anywhere and put anything anyplace. If they were really having people do this, I expect there would be a notice in my account when I log in, and there's not. It's a clever scam, but it's still a scam. You were exactly right in forwarding it to their spoof department. bonni

Yup, Paypal verfied it as a fraudulent email....=)

I didn't get one either. Smells like scam.

Yet if you type in the URL they give you and browse around the site, you'd swear it was the actual paypal site....

I suspect that if you type the URL you do indeed end up on the real Paypal site - it certainly showed my email address in the login box. What they probably wanted you to do was click on the link, rather than typing into the address bar, which would have taken you to a spoof site that looked as if it was at the correct URL. I think Win XP SP2 is meant to have closed, or at least reduced, this vulnerability.

Seems like a fairly obvious phishing scam. Ignore.

For 1. Paypal will never send any emails to its members asking for info.

This is NOT a SCAM or HOAX

That should be the second warning ;) Comes right at the start of the email.

ALL accounts not re-verified within 5 days of receiving this email will be automatically frozen

The scare tactic.

As far as not mailing to your name, I would think Paypal knows who is who in their memberbase. ;)

** Protect Your Account Info
A genuine PayPal link will always begins with "http://www.paypal.com"

Remember to check your browser's Address/URL Bar to be sure you are on an authentic PayPal site.

Please make sure the link you click on starts with "https://www.paypal.com"

Paypal will never ask for sensitive information. PayPal sites that ask for Passport information, Driver's licence details are definitely scams.

For more information on protecting yourself from fraud, please visit the Security Center.**

This is put in to give you peace of mind..but notice nowhere they tell you to 'type' in the url...always referencing a 'link'

If anything, type in the url of the Paypal site, then check your account..if paypal needs to inform you of anything, they will do it there...they wont send you an email.

Message edited on: 12/10/2004 10:25

I get fraud PayPal emails all the time :( It's important to keep in mind that any Legitimate email from them will usually ask you to log into your account for any information that needs to be verified. (BTW- it's extremely rare) The links are usually spoof type urls. Don't click on any of them, just log into your PayPal account. Thanks for posting about it. It's a real problem. Those fraud emails fool a lot of people into entering in personal info usually including credit card info :(

from the BBC technology correspondent:

"Net security firm Secunia has discovered a way to use pop-up windows to fool even cautious users into thinking they are on an official site when in fact they are giving information to a phisher.

What happens is that a user clicks on a link in an e-mail or on a web page, and their browser opens up the real site, a bank or auction house, say. But at the same time an invisible window onto a malicious site is opened. Then if the legitimate site opens a pop-up window, as many do, the malicious site is able to hijack it and write whatever it wants onto the screen.

This could be a link to another part of the malicious site or even a form asking for login details.

I tried it myself, using the demonstration on Secunia's website, and it worked with both Firefox and Internet Explorer.

Perhaps the worst thing about this exploit is that it is not technically speaking a bug. Everything works as it is supposed to, and there are no program errors or sneaky viruses involved.

It is just that the way pop-ups are handled by browsers does not inform the user when another browser overwrites the content that has been written by the original site. "

put it this way. if you get an email asking you to visit ANY site to confirm your details delete it. don't even go to have a look to see if it's fake. just place it into your deleted folder then nuke it.

Message edited on: 12/10/2004 11:24

ANY email that starts with a generic "Dear PayPal user" or "Dear EBay user" and/or asks for re-submit personal info is a verified scam, as explained on the official sites. Real ones address you with your name, and never asks you for details.

Quote - if you get an email asking you to visit ANY site to confirm your details delete it. don't even go to have a look to see if it's fake. just place it into your deleted folder then nuke it> Quote -

minor exception, verify email address when signing up for an account with a lot of corportate sites.

also activation of account is held off until verified that email addy is valid but then it is an expected email, not one from out of no-where. Message edited on: 12/10/2004 14:46

I Auction on eBay, and so I get emails from PayPal and eBay all the time, one or two a day, I 'expect' to receive something from them notifying me of payment or confirmed listings, etc. so I have to be especially diligent when reading these things....others who also deal with ebay and Paypal that might be new or inexperienced might just think these scams e-mails are legit, because the scam is so well crafted, that's why I posted the email....I may just be the first to get this, and so everyone should now be forewarned....

Please remember, at no time will any legitimate agency/company ask for your information or password. Common companies being inmpersonated for Phishing: Verizon AOL PayPal Suntrust Bank Citicorp AOL was recently the victim of a theft that involved 1000's of member names. Law enforcement has made several arrests in this case, but the list was basically stolen by an employee and then sold.

I get Citicorp all the time, but not having an account I just have fun put any old thing into their phishing pages, the pages don't verify the info so you can really screw with them.....=)

I view any email from paypal as fraud, whether it comes from them or not. ;)