Paypal Spoof email

Ruud

Hi

Today i brought a item from ebay and i paid for it using a debt card (Switch) payment went through alright, because i paid by debt card a paypal account was created for me for future use.

A while after i recieved an email saying click here to activate your account so i stupidly click on the link and loged in!. Later i relised i shouldnt off done that so straight away i forward the email to spoof@paypal.com they replied saying We can confirm that the email you received was not sent by PayPal i thought omg what have i done. so i quicky loged into my account through the proper paypal site and changed the password and the 2 secret questions.

No other transations have been made on my account apart from the one i did myself on eaby. But im scared that ive messed up big time.
Should i close my paypal account and open a new one another time?

Thanks all for reading

Sugar_Coated_Owl

In the email that you received supposably from PayPal, did it include your full first name/surname or did it start 'Dear PayPal member' or something similar?

pennylane99

any email you send to spoof@paypal they reply saying its a spoof, even if it isnt...its just an automated response.

I would change your Ebay password too just in case.

Ruud

it starts with

Activate your PayPal account by confirming your email address

Dear xxx xxxxxxxx

To complete your PayPal account, you must click the link below and enter your password on the following page to confirm your email address.

Click here to activate your account

The URL is service@paypal.co.uk

pennylane99

Ruud wrote:

it starts with

Activate your PayPal account by confirming your email address

Dear xxx xxxxxxxx

To complete your PayPal account, you must click the link below and enter your password on the following page to confirm your email address.

Click here to activate your account

The URL is service@paypal.co.uk

if you press to reply to the mail, you can usually see there is an extra email addy tagged on to the service@paypal bit for the spoof. Where its actually come from somewhere else

There is a "sticky" thread at the top of this forum all about spoof emails.

Ruud

Return-Path: <service@paypal.co.uk>
Received: from rly-yj02.mx.aol.com (rly-yj02.mail.aol.com [172.18.180.140]) by air-yj03.mail.aol.com (v114_r1.17) with ESMTP id MAILINYJ31-80045af7b8b14; Thu, 18 Jan 2007 08:52:51 -0500
Received: from outbound1.den.paypal.com (outbound1.den.paypal.com [216.113.188.96]) by rly-yj02.mx.aol.com (v114_r1.17) with ESMTP id MAILRELAYINYJ210-80045af7b8b14; Thu, 18 Jan 2007 08:52:12 -0500
Received: from mx0.phx.paypal.com (phxmail6.phx.paypal.com [10.190.3.80])
by outbound1.den.paypal.com (8.13.7/8.13.7) with ESMTP id l0IDq9Zk024748
for <xxxxxxxxx>; Thu, 18 Jan 2007 05:52:09 -0800
X-DomainKeys: Sendmail DomainKeys Filter v0.4.1 outbound1.den.paypal.com l0IDq9Zk024748
Authentication-Results: outbound1.den.paypal.com sender=sendmail@paypal.com; domainkeys=neutral
Received: from mx1.phx.paypal.com ([10.190.3.65])
by mx0.phx.paypal.com (8.13.7/8.13.7) with ESMTP id l0IDq9Q1028477
for <xxxxxxxx>; Thu, 18 Jan 2007 05:52:09 -0800
X-DomainKeys: Sendmail DomainKeys Filter v0.4.1 mx0.phx.paypal.com l0IDq9Q1028477
Authentication-Results: mx0.phx.paypal.com sender=sendmail@paypal.com; domainkeys=pass (testing)
Received: from of-x336.ca1.paypal.com ([10.190.3.65])
by mx1.phx.paypal.com (8.13.7/8.13.7) with SMTP id l0IDq80U001215
for <xxxxxxxxx>; Thu, 18 Jan 2007 05:52:08 -0800
X-DomainKeys: Sendmail DomainKeys Filter v0.4.1 mx1.phx.paypal.com l0IDq80U001215
DomainKey-Signature: a=rsa-sha1; s=dkim; d=paypal.com; c=nofws; q=dns;
b=odcNQqVKFfngAfxXAw3tKCtWZPYny+N0SE4pMVbP1TRjxk4HyaAhjAUw0vTMIQ0Kt
3LBU8xEQipD/OQ6FPoJYlP0Y7EQotTFr5zSM1XNHnF+M2TPlgnT91W1s4ijFfvt8A6O
Dz1GTOYhkZeqeU1UxFzTug4np1rjlJjCgkADbrM=
Received: (qmail 17969 invoked by uid 99); 18 Jan 2007 13:52:08 -0000
Date: Thu, 18 Jan 2007 05:52:08 -0800
Message-Id: <1169128328.17969@paypal.com>
Subject: Activate your PayPal account by confirming your email address
X-MaxCode-Template: email-email-confirmation-new-personal
To: xxxxxxxx <xxxxxxxxx>
From: "service@paypal.co.uk" <service@paypal.co.uk>
Sender: sendmail@paypal.com
X-Email-Type-Id: PP468
X-XPT-XSL-Name: /default/en_GB/account/EmailConfirmationNewPersonal.xsl
Content-Type: multipart/alternative;
boundary=--NextPart_048F8BC8A2197DE2036A
MIME-Version: 1.0
X-AOL-IP: 216.113.188.96
X-AOL-SCOLL-SCORE: 1:2:487434462:6710886
X-AOL-SCOLL-URL_COUNT: 4

That the details from the email that i had where you see xxxxxxxxxxx thats to cover my personal info

Sugar_Coated_Owl

It looks authentic. If it included personal information e.g. your full name then I would assume that it was. If a PayPal account had been created for you because you had recently paid with a debit card then it makes sense that PayPal would want you to activate it.

pennylane99

actually...the outgoing IP address of 216.113.188.96 is registered to Ebay

Search results for: 216.113.188.96

OrgName: eBay, Inc
OrgID: EBAY
Address: 2145 Hamilton Ave
City: San Jose
StateProv: CA
PostalCode: 95008
Country: US
NetRange: 216.113.160.0 - 216.113.191.255
CIDR: 216.113.160.0/19
NetName: EBAY-QA-IT-1
NetHandle: NET-216-113-160-0-1
Parent: NET-216-0-0-0-0
NetType: Direct Assignment
NameServer: SJC-DNS1.EBAYDNS.COM
NameServer: SMF-DNS1.EBAYDNS.COM
NameServer: SJC-DNS2.EBAYDNS.COM
Comment:
RegDate: 2003-05-09
Updated: 2003-10-17

OrgTechHandle: EBAYN-ARIN
OrgTechName: eBay Network
OrgTechPhone: +1-408-376-7400
OrgTechEmail: network@ebay.com

pennylane99

Ruud wrote:

Hi

Today i brought a item from ebay and i paid for it using a debt card (Switch) payment went through alright, because i paid by debt card a paypal account was created for me for future use.

I assume by the above, you didnt have a paypal account prior to paying by the switch card.
The IP address says the mail did come from Ebay.
Looks like it was just the usual email they send to confirm your email address and click the link to activate your account.

PayPal Basics and Benefits - Account Setup - Confirm Email Address

How do I confirm my email address?
After you register, you'll be sent an email containing a link that will take you back to https://www.paypal.com/uk where you'll be asked to enter your password. Your email address will then be confirmed.

If your email programme has trouble with hyperlinks, you can also manually confirm your email address

Ruud

no i didnt have a paypal account prior to paying by the switch card, im so glad that you guys now think it did come from ebay.
But why did paypal reply saying it was a fake? Was it because it came from Ebay and not Paypal

pennylane99

Ruud wrote:

no i didnt have a paypal account prior to paying by the switch card, im so glad that you guys now think it did come from ebay.
But why did paypal reply saying it was a fake? Was it because it came from Ebay and not Paypal

anything you send to the spoof address comes back as a fake...it just seems to be an automatic reply....

its always best to be cautious these days anyway.