full-disclosure - Is this a paypal scam?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20040318184502.GD16214@sherohman.org>
From: esper at sherohman.org (Dave Sherohman)
Subject: Is this a paypal scam?

On Thu, Mar 18, 2004 at 10:37:58AM -0600, jschmidt@...ler.com wrote:
> http://218.62.43.30/verify.html
> 
> Signed up for paypal 2 weeks ago, and then this came in the mail as a link 
> in a paypal looking html email asking me to confirm by entering my credit 
> card/account info.

As PayPal states repeatedly, "You should only share information about
your account once you have logged in to https://www.paypal.com/."
Not http://218.62.43.30/verify.html.

IOW, yes, it's a scam.  Report it to fraud@...pal.com.

> If this is a scam, then maybe paypal has some employees passing new 
> account info outside the company.

No, it gets sent to everyone whether they have a PayPal account or
not.  Like spam, credit card scams don't even need anything close to
a 1% response rate to be profitable, so they don't care how many
non-PayPal-users get it.

-- 
The freedoms that we enjoy presently are the most important victories of the
White Hats over the past several millennia, and it is vitally important that
we don't give them up now, only because we are frightened.
  - Eolake Stobblehouse (http://stobblehouse.com/text/battle.html)