Email from Paypal - how do I know it's from them?

PinkLady

Hi
I have had an email from Paypal asking me to update billing information - but I'm scared to click on the link in case it isn't from them! The start of the link is https://www.paypal.com/us

If this is email is real - can I change things without clikcing on the link - don't know where to look on Paypal to do this.

The email says:

It has come to our attention that your PayPal Billing Information
records are out of date. That requires you to update the Billing
Information.

Please update your records in maximum 24 hours otherwise your account
will be suspended.
Once you have updated your account records, your PayPal session will
not be interrupted and will continue as normal. Failure to update
will result in cancellation of service, Terms of Service (TOS)
violations or future billing problems.

Please update your billing records:

I would appreciate any advise - 24 hours is a bit of a quick time to insist I do something!

Thanks

highguyuk

Visit https://www.paypal.com and log in as you usually do - dont use the link.

If any needs updating, do it this way - although I must admit things like this are usually a scam.

PinkLady

Thanks - I think it could be a scam - how do they know my email address and know I have a paypal account - it's a bit scary!

melancholly

You should be able to do everything like that after logging into paypal in the normal way. In their advice online about dodgy emails they recommend openning a new brower and logging in on the https://www.paypal.co.uk site. The other hint is that a real paypal email will give your full name or business name after 'dear' at the top of the email. If you're unsure, don't use the link and go via the main login page - if it is something vital then it will direct you to the right place (i've never had that request and 24 hours seems very short and suspect!)

soolin

PinkLady wrote:

Thanks - I think it could be a scam - how do they know my email address and know I have a paypal account - it's a bit scary!

It's totally random. If the spammers send out 10,000 emails they are bound to pick on some email addresses where the user has a paypal account.

I get these sort of emails even to email addresses I don't use on ebay.

Also, like melancholly says they will always address you by your registered name, not just as dear 'email address'.

Send it to spoof@paypal.com.

Soo

Realist

If you place your mouse pointer over the URL in the email and then look at the address that it points to. These emails are spoofs/spam !!!!!!s trying to gain your login details.

DONT EVER, EVER beleive these emails are from Paypal because Paypal will never, ever ask you to verify your details like this.

The other way to check if the address is correct is right click on the email, click properties, click the details tab, then message source. from there you can see the actual address the spammers are using, as an example:

I receive these emails myseld and using one I've received as an example:

The email details show this:

Return-path: <service@paypal.com>
Envelope-to: xxxxxxx@xxxx-xxxxxx.com
Delivery-date: Sun, 15 Jan 2006 02:47:25 -0500
Received: from xxxxxxxx xxxxxx.xxxxxxxx.com with local-bsmtp (Exim 4.52)
id 1Ey2bh-0001rz-AK
for xxxxxxx@xxxx-xxxxxx.com; Sun, 15 Jan 2006 02:47:24 -0500
Received: from [24.139.25.153] (helo=192.168.41.101)
by saturn.ragezone.com with smtp (Exim 4.52)
id 1Ey2bh-0001ru-1r
for xxxxxxx@xxxx-xxxxxx.com; Sun, 15 Jan 2006 02:47:21 -0500
Received: from 199.86.94.112 by ; Sun, 15 Jan 2006 13:38:14 +0600
Message-ID: <LNKXESNSEAPJOTQMYPLK@charter.net>
From: "PayPal Email ID PP321" <account@paypal.com>
Reply-To: "PayPal Email ID PP321" <account@paypal.com>
To: xxxxxxx@xxxx-xxxxxx.com
Subject: PayPal Email ID PP321
Date: Sun, 15 Jan 2006 08:42:14 +0100
X-Mailer: The Bat! (v1.52f) Business
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="--82046388127320794059"
X-Priority: 1
X-MSMail-Priority: High

As you can see from the above, the sender is using a program called "The Bat" Paypal dont use this software so thats one give away.

Now when you click source you can scrool down to the actul http email message and you will see that the link in there message is actually being redirected to:

DONT CLICK THIS LINK YOU HAVE BEEN WARNED _http://eso.cssmi.qc.ca/~web/.us/index.php?MfcISAPICommand=3DS=
ignInFPP

<p>Dear PayPal User,<br>
<br>
We recently noticed one or more attempts to log in to your PayPal <br>
account from a foreign IP address.<br>
<br>
If you recently accessed your account while traveling, the unusual log <br=
>
in attempts may have been initiated by you. However, if you did not <br>
initiate the log ins, please visit PayPal as soon as possible to update <b=
r>
your account:<br>
<br>
<a href=3D"http://eso.cssmi.qc.ca/~web/.us/index.php?MfcISAPICommand=3DS=
ignInFPP" onclick=3D"return ShowLinkWarning()" onfiltered=3D"return ShowLi=
nkWarning()"
>
https://www.paypal.com/us/cgi-bin/webscr?cmd=3D_login-run</a><br&gt;
<br>
Changing your password is a security measure that will ensure that you <br=
>
are the only person with access to the account.<br>
<br>
Thanks for your patience as we work together to protect your account.<br>
<br>
Sincerely,<br>
PayPal <br>
<br>
<br>

So, there ya go, check these emails like your life depends on it.

Laters

nightswimmer

melancholly wrote:

The other hint is that a real paypal email will give your full name or business name after 'dear' at the top of the email.

Just a warning, I have had a couple PayPal scam e-mails that have used my full name. So whilst it's true to say that any PayPal mail that doesn't use your full name is fake, it should also be pointed out that just because they use your full name, doesn't mean it's real.

soolin

nightswimmer wrote:

Just a warning, I have had a couple PayPal scam e-mails that have used my full name. So whilst it's true to say that any PayPal mail that doesn't use your full name is fake, it should also be pointed out that just because they use your full name, doesn't mean it's real.

If the scammers have your full name then you might have slightly more problems than just being picked up by a random scam. It probably means you have used your email address in conjunction with your name in an unsecure situation and a spam bot has picked them up.

I had to give up an email address last year as I had posted to an open forum and didn't realise at the time that my posting email was shown against my name. It was OK as I wasn't using my real name, but for a while I did start getting emails that were actually addressed to that fake name.

Soo

nightswimmer

soolin wrote:

If the scammers have your full name then you might have slightly more problems than just being picked up by a random scam. It probably means you have used your email address in conjunction with your name in an unsecure situation and a spam bot has picked them up.

eeeek :eek:

I *think* I'm safe, but just I'll run it by you just in case...

I have one e-mail account which is where all my non-eBay official PayPal related messsges go to.

I have a seperate e-mail address for my eBay selling account. The only time I use this address is in relation to my eBay selling (replying to questions, communication with customers, etc. and it's printed on the receipt I include with every order I send out). I use it for nothing else, and have never given it out on a Message Board, Newsgroup, etc. When I first started using it, my e-mail address did have my full name in front of it on any messages I sent out, but i corrected that after a couple months, and it now just has my first name.

The spam was sent to the address I use for selling (this is how I knew it was fake before i even opened it). It consisted of a HTML message, with my full name in text, with a .gif image below made to look like a PayPal payment page saying that I had just made a payment to "BlahDeblah Company", with a link saying something like "If you want to cancel this payment, click here".

I think I am pretty clued up on what to look for in fake PayPal/eBay messages, but even still, i only ever log into eBay/PayPal through their official sites, never through any e-mail link that I may have received.

The only way that I can see them getting hold of my address and full name, is if they were a previous customer, or if they had asked me a question back when the e-mails that I sent out had my full name in front of the address.

Can you think of any other ways they may have got my address and full name?

Realist

A past customers system could of been compromissed and there emails stolen.

soolin

nightswimmer wrote:

eeeek :eek:

I

nightswimmer I'm sorry to have alarmed you..even though they have your details they can't do you any damage. It just means that they can target scam mails more effectively.

The only reason I changed my email details and gave up the compromised address was because I believe they sold my details on, and I started getting targetted mail that became a nuisance.

Soo