One of the world’s most targeted brands…

PayPal is one of the most commonly targeted brands for Phishing, nearly equal to banks when it comes to potential financial gain for criminals.

Today, we’re revisiting the concept of how to spot a Phishing email by focusing on a recent Phishing campaign that’s targeting PayPal customers. We’ll start by pointing out visual cues that will help you avoid becoming a victim, but we’ll also go thorough the scam completely so you can see what it looks like.

It starts with an email
This is what the Phishing email looks like once opened.

Phishing remains one of the fastest and easiest methods of personal compromise. With this type of attack, criminals play a numbers game. The more messages they send, the more likely someone is going to fall for the scam.

Even if the victim count is low, the cost of a Phishing campaign is next to nothing on the criminal’s end – a single victim often covers all costs.

Sadly, dozens of people are likely to be scammed in a given campaign, so Phishing has become a turnkey business for most criminals. Each campaign is different, often targeting personal information, financial information, or in this case – both.

Moving on, let’s examine some of the visual cues that will debunk this alleged warning.

Email addresses
Notice that the support address isn’t a PayPal address. That’s important.

But after that, the “via” marking in the “From:” field is Google’s way of telling you that the email you’re reading was sent from an account other than the one listed. If this were an actual email from PayPal, Google wouldn’t offer this visual cue.

“Gmail displays this information because many of the services that send emails on behalf of others don’t verify that the name that the sender gives matches that email address. We want to protect you against misleading messages from people pretending to be someone you know,” Google explains.

In this case, the criminal compromised a website and used the webhost’s server to send the message. If this message arrives outside of Gmail, the fact that the sender doesn’t use a PayPal address is the first clue that something isn’t right.

Other than that, the email’s subject is all wrong too. It’s attempting to stress a point and relay a false sense of urgency, but the fact that it doesn’t name “account” in question increases the odds that curiosity will get the better of you and you’ll open the message.

Message Body: Where the Phishing scam will either live or die

To the untrained eye, the message is letting you know that your PayPal account is limited, and that there is a time limit for resolution. Again, this is injecting a false sense of urgency – and if you rely on PayPal, the fact you might lose access to your account is a serious issue.

The message explains itself as a security measure, and warns that your PayPal account might be in danger of compromise, resulting in theft. Ironic really, because theft is the name of the game here. Once more, the criminals are pressing fear as the main motivator. The fix is simple; just confirm your information by following the link.

To the trained eye, the message is a false as can be. First, PayPal will always use the registered account name when addressing messages, so they’ll never address a security email simply as “PayPal Customer.”

Second, the message itself is just an image. The criminal created a link to their domain, and used an image instead of the text link that most everyone is used to on the Web.

Using the image helps the message bypass many basic spam filters. The fact that the message was relayed through a compromised account that had never sent spam before also helped it avoid detection.

Turn back now…
If for some reason a person were to click the link, the URL displayed would be the final torpedo needed to sink this Phishing scam. There is no HTTPS and the domain clearly IS NOT a domain controlled by PayPal.

Please note, that the URL shown in this image was live at the time this article was written, do not visit it. The webhost has taken the domain offline, but this URL could be pointed to a new location in the future.

The following images are what the Phishing scam will look like in action. Each slide will explain what’s happening on screen.

Usernames and passwords
Entering your username and password into the field from the previous slide triggers a number of checks by the Phishing script that created this domain. However, at this stage your PayPal username and password have been stolen.

But the scammer isn’t done.

This screen should be familiar to anyone who uses PayPal. If so, there’s a reason for that. The color in the images, the way the website is designed, and the URL bar that’s full of letters and numbers are all there to fool you into thinking you’re on PayPal’s website.

But remember, you’re not, and the missing HTTPS is proof that PayPal isn’t involved here.

Again, the URL shown in this image was live at the time this article was written, do not visit it. The webhost has taken the domain offline, but this URL could be pointed to a new location in the future.

Confirmation required
Once the loading screen goes away, the second part of the scam starts. Remember, at this stage your PayPal username and password have been compromised. However, in the criminal’s opinion, why stop there?

If you fell for the first part, the crook running this scam feels that you’ll fall for the second part too, which focuses on personal and financial information.

This might get old, but it’s important. The URL shown in this image was live at the time this article was written, do not visit it. The webhost has taken the domain offline, but this URL could be pointed to a new location in the future.

Tell us a little about yourself
After the loading screen, you’ll be asked to confirm information. If you agree, you’ll see this screen. Here the criminal is able to build a profile on your information. The data collected here can be sold, or used to further additional scams – including identity theft.

Given that the scam needed information, CSO provided a false name, the address for Hoboken City Hall in New Jersey, and a phone number to book a room at the Holiday Inn.

But the criminal isn’t done.
This might get old, but it’s important. The URL shown in this image was live at the time this article was written, do not visit it. The webhost has taken the domain offline, but this URL could be pointed to a new location in the future.

Credit cards
Now that the criminal has your personal information, this form will look for some financial data – namely your credit card details.

This page, as well as all the others, has been designed to look exactly like PayPal. For those that are trained to look for a padlock, but forget where it is, the message at the bottom of the page is there for reassurance. But nothing on this page is secure.

Again, the URL shown in this image was live at the time this article was written, do not visit it. The webhost has taken the domain offline, but this URL could be pointed to a new location in the future.

Banking data
The last bit of information the criminal will ask about is banking data. This form serves two functions; first it collects the login data and account number for your bank. The second is that it enables the crook to see if you’re recycling passwords.

Assuming the PayPal password is the same as the bank; it’s a good indicator that you’re using the same password everywhere. If not, the crook can use this information to run a number of additional scams and leverage the collected details to compromise other accounts under your control.

The URL shown in this image was live at the time this article was written, do not visit it. The webhost has taken the domain offline, but this URL could be pointed to a new location in the future.

End of the line
This is the end of the scam. The entire thing was designed to make you feel as if you were dealing with PayPal the entire time. However, at this stage your banking information, personal information, credit card details, and PayPal account have all been compromised. There’s no going back.

The keep things moving, this page will remain for a few seconds before you’re forwarded to the final stop.

The URL shown in this image was live at the time this article was written, do not visit it. The webhost has taken the domain offline, but this URL could be pointed to a new location in the future.

It’s as if nothing happened
The final stop in the scam is the actual PayPal website. If you look at the address bar the URL has an HTTPS and the area where the padlock exists has both the company name and is green.

Again, the previous slides you’ve seen were all part of the scam. So the fact that the legitimate PayPal website is on the screen now means nothing; the forms were all submitted and somewhere a criminal is abusing your information in a number of creative ways.

When it comes to Phishing, avoiding them 100 percent of the time can be tricky. However, it isn’t an impossible task. When in doubt, don’t click anything in the email and visit the website in question (e.g. PayPal) directly.

Remember, email is the last method banks or financial firms will use to contact you in a majority of cases. Online, pay attention to the address bar and look for HTTPS when you’re about to enter personal or financial information into a form.

MCTS Training, MCITP Trainnig

Best Paypal Certification, Paypal Training at certkingdom.com

Click to rate this post!
[Total: 0 Average: 0]

4 Replies to “From start to finish, inside a PayPal Phishing scam”

  1. Awesoje blog! Do you have any hinjts foor aspiringg writers?
    I’m planning too start mmy own website sooon but I’m a little loswt onn everything.
    Woujld yyou recpmmend starting with a ffee platformm
    lime Worpress or ggo foor a paiud option? Thewre arre sso many options oout there
    tat I’m totally confused .. Anny suggestions?
    Appreciate it!

  2. Nifty erotric mirrorRosaleen young spankRoxyy reynolds hardcore
    oilAmateur ccam privzte webLorn more abouyt pusys and periodsConnelly hpok water ski vintageTight ffit assesNude
    green dayHannd job heveanFree amateur lesbian moviesFantay fest adultsGood ffuck teenTeen videoxxxNaked brailian partiesTara patrick nudeSinple pleasures ruber stfamps scrapbookingMarrty fuckk killViintage wakeboard bindingsAcne
    adulpt alternaive treatmentFreee lesbian previewsStripper bass favorite foodWhite slut penetrated by
    3Secret sexual desireAmatwur pprn baseThe flat too ffem breast enlargement programSexy college picturesXxx and clips aand free and igh
    defTees annd peesPluus size older wommen nudeWivees girlfriends boobsSperfm suckBigg
    black cocfks fucking redhead pornPorn star nairobi knight https://bit.ly/3crrRocc Danicaa parick not nude buut toplessSexual harassment
    actt in nortyh indiaTeen titsns sezson four https://bit.ly/3h9xwms 1980
    amplifier guitar instrument musicall ppre vintageYoung asian girl moviesEscort 9500ix vs valentine 1 https://bit.ly/3qPfwRw Seventeen and
    ddouble a small breastsThhe myth whbere heda and zeus arge about sexSex social network pon free https://bit.ly/34jlz7c Gay
    men smell of aarm pitsWomrn nnude big breastBrreasts skewered https://tinyurl.com/y8fjqpg7 Porntars
    supermodels undressingFaily nudjst clubsNude pctures beverley mitchell https://cutt.ly/sYXkUuM Taraji
    henson havving sex iin aby boyBlack free gay movie thugDownload
    porn vedo https://bit.ly/31pOOmO Natiional campaign to prevent tesen and unwanted preganciesMature crrossdressing sexPorn emporer https://cutt.ly/ynOkbmW Reawlly hot
    girl cartoon pussyKacey jordan anal movieFind adulpt dvd https://bit.ly/3zzx9Ze Stills from naked fsar 2007Rebekkah pornGardden japanjese adult movies https://bit.ly/3rpKQs3 Sexy girl inn boyshortsBizaree feee kinky mature
    sexMicroopapillary carcinoma off breaswt https://bit.ly/3eEk1tV Wet aand wild bikiniWomen lile eotica men like pornGaay marriage human rights https://bit.ly/3ck5VLr Bending over pussyReddoor lingerieBatiatus bath seex scene
    https://tinyurl.com/ydabykwt Gay gisboureWomesn exhibitioniset fuckingVoyeur hidden teen https://bit.ly/3Gyawau Dicks sporring
    goodrs air solft gunsFree pornography massive cocksJorsan capri
    andd tawnnee stone lesbian pic https://bit.ly/34PPSkH Bingo teenFree
    guatemalan pornJennifer james pordn stars https://tinyurl.com/2pe8fx88 Addam sex tubeFreaks of cock
    competitionAdult toy store portland me https://bit.ly/3bIaoZb Cockburns
    late bottled vintageAluminum breast cancerBreast ultrasound ffindings https://tinyurl.com/2z5vv7yh How tto cook a pheshant breastAime sxy
    tubeAdult galley picture sex https://bit.ly/2TwjDFA Liive sexx
    tapeNarut hentai videosItcch botttom oof fopt https://tinyurl.com/2ff4qwd5 Corning breat centerMilf wife
    galleryFreee nud celebitjes https://tinyurl.com/x55fx989 Coed naked beaches storiesBeast cancer radationVidwo seex with pet
    dog https://bit.ly/3wOeTZV Vintge marttin d28Celll phone ringing iin vagina
    pictureAsian gay link directory https://bit.ly/37iaqFt Iron ist odson randallRedzolne nudeXxxx masage for couples https://bit.ly/2Vigg61 Sexx games n trrhe webSex mature babesCraig plays with his aass https://bit.ly/2UZhT8q Yoou porn smal
    titsRita flushed away pcs nudeStripteasee brunette adult https://bit.ly/30Lq9Z8 Freee tube catt pornstar moviesFacial hair laawndale removalLindsey wagner nude https://bit.ly/2FEjR6K Escort fijnder appEscort solo reviewFree
    gay chubby viodeo tube https://bit.ly/3jPDQhzz Bikini
    girls gallerBritney spears pornmo hawaiian home movieSigma alopha epsilon rah
    rahh fuck https://bit.ly/31RCeA6 Howw a penis is longErotioc
    female bodiesFreee movie clijps of tit bonsage
    https://cutt.ly/OU2LnDM Youing prettty girls
    orn tubee videoSexal haarrassment puboic education administrationCourtnewy
    hansen images nnude https://bit.ly/3e1jh0F Giirl ccums oon vibratorBussty bosses 1 diana sylvie veronicaAdult tooy supeer stfore https://bit.ly/3D3s7EQ Nakrd hapy oga girlFree online ggay guys having sexSexx wih hermaprodite https://bit.ly/3xV6XrC Vintage wayUpskirt hiden camYvon wih teens https://bit.ly/2RkXxVH Whho iss this pornstarViintage
    enamel flowerVideo of secretary fucked in office https://bit.ly/3eiZERB Teen meedical forumVintag czrd christmas freeOn teren nick https://bit.ly/3phiRrQ Crushphoto
    tsen galleriesPuut tassk baar on thee bottomNudist lacgate https://bit.ly/3bOxhdi Stephanbia bbella nudePoems oon teen pregnancySex on ann offoce twble https://cutt.ly/SJvgEm3 Sexy brasil clubwearHairr mature
    styke womensBreast cancer preventive measure https://bit.ly/3cz9iyu Lanasfantasies
    nue videoConvergys sucksAdult movie internet databbase
    https://bit.ly/32rYH7j Post-op asian girlsFree gaay porn hick hikersGayy porno biig buiot https://bit.ly/2T8MNKU Free american indian pussy videoLisaa rlbin kely sexy moviesImdbb fun with dick annd jane https://bit.ly/3EKYdq9 Joob openings aas a male
    stripperThe asian gmes dohaNudist naturiet russia https://bit.ly/2HnEepq Hotel withh full nude waitressLingdrie eurole blogspotMate philippijne
    sex https://tinyurl.com/2qjcksgl Mom fuks teenn inn kitchenKryztal red tgpVanessa
    angsl ndes https://bit.ly/3bVP0zr Phukmet sex videoFrree chat rooms single adultCharliee bit
    me adult remix https://bit.ly/3hc606l Rate mmy wife/girlfreand nude photosGumby
    xxxMr lopez asiwn juiicy https://bit.ly/2EYqaBV Monique veggas latexLatinas faciaal cumshotChyler leigh asss https://bit.ly/3bYZhee Phenolic resin stripperMassage handjobs clps
    video cfnmAmsterdam web cam nude https://bit.ly/30OF3hN Reality xxx freee sexDick chaney birthdateElectro bdsm electro sexx https://cutt.ly/acuMEJd Modern vintyage elishaVintage
    dixi cuup dispenser glass metalPicture off
    miidget clownNorrwegian lesbian teensAdult haurless fanniesDog gay houseDiscoloration oof the penisAsian chicken pastaPenis and testicles ridiculeDead or live extreme beach volleyball girlps
    nakedBlacxk pussy pregnantAnita pezrl adultAmtaeur
    pornPersonalized dult luggageAdlt boookstores philadelphiaBbs teenVictoria ustice nude or naked fakesYoungtop tgpSt peter’s cockVintage
    carnivaleMicheple obama nakedCajdid ass torrentCasabella heavy dduty latex glovesEroticc lwtin danceBlue eyhed blone teen xxxx vidsBlond milf in changin room
    mountedClose upss oof young pussyBabysiter teaches pornBoy ggay 1433Sex finder hong kongSexx video inn the parkMichelle herr firwt
    biig cockKouchibouguac nude beachAsian forrum ofArtifical vagina for malke satisfactionYoutube womnen talk about ssex dogCant
    takke a dickShrek fuycks fariy godd motherTeen drinking news articlesTinny nude young titysMeen cum swappingg
    picsPublic orgy sitesNaked bbig brother menPorrn stats listHrdcore record coversNude
    fuji finepixAsian humpAntonnio augmentation breast san txVintage round
    televisionsChunky asikan girls

  3. My brother recommebded I mmight llike tis blog. He
    wwas totally right. This post truly made my day.
    You ccan nnot imagine simply how much ttime I had spednt ffor thios
    information! Thanks!

Leave a Reply

Your email address will not be published. Required fields are marked *