How Do They Know?

The machines we love to hate

Moderator: Wiz Feinberg

Post Reply
Jimmy Gibson
Posts: 892
Joined: 13 Nov 2002 1:01 am
Location: Cornwall, England

How Do They Know?

Post by Jimmy Gibson »

It seems every time I use my PayPal account I start getting these phishing emails.
I always report them to PayPal and they say they are trying to stop these fraudsters but how can they?
because as soon as I use my account again I start getting the dodgy emails again.
Has any one else on the forum ever have this problem?


Jimmy.
User avatar
Jack Stoner
Posts: 22136
Joined: 3 Dec 1999 1:01 am
Location: Kansas City, MO

Post by Jack Stoner »

I use paypal relatively frequent and have not had the problem.

It may be your local link is not as secure as you think? Or it may just be coincidence.
User avatar
Cal Sharp
Posts: 2874
Joined: 4 Aug 1998 11:00 pm
Location: the farm in Kornfield Kounty, TN
Contact:

Post by Cal Sharp »

I use PP almost every day and I don't get any more phishing emails than I ever did, when I was only using it every few weeks. You might try changing your email addy in your PP account and see what happens.
C#
Me: Steel Guitar Madness
Latest ebook: Steel Guitar Insanity
Custom Made Covers for Steel Guitars & Amps at Sharp Covers Nashville
User avatar
Wiz Feinberg
Posts: 6103
Joined: 8 Jan 1999 1:01 am
Location: Mid-Michigan, USA
Contact:

Post by Wiz Feinberg »

Jimmy;
When one uses PayPal they are either transferring funds to/from their bank, editing account details, obtaining website payment codes, making a payment or requesting one. Which of these things have you been doing after which you receive phishing emails? How much time usually elapses before the emails begin?

In the case of people purchasing things on eBay and paying with their PayPal accounts, the sellers receive your email address and usually send you a message regarding the delivery status. Some even link to Auctiva and it sends you winning notices and recommendations for other auctions, to the same email address.

If the eBay seller, or Auctiva, or eBay gets their member database hacked, user names and email addresses may be harvested.

So, if you use PayPal to buy stuff on eBay, etc, and the seller receives your email address and his or her computer is infected with an information harvester bot, your email will be added to a fresh list of known active accounts to be sold to spammers.

You can assign up to 8 email accounts to your PayPal account and designate one to be the primary/default account for communications. Why don't you create a new account with your current email provider, then add it to your PayPal account and make it your primary? Do whatever it is you were doing before, just once, and see if that new account gets spammed or phished. If nothing odd happens, do another typical transaction and watch for something phishy. If a phish lands, figure out who received your email address, which was (almost) never used before and report this to them, or to PayPal. They may be infected with a harvester bot.
"Wiz" Feinberg, Moderator SGF Computers Forum
Security Consultant
Twitter: @Wizcrafts
Main web pages: Wiztunes Steel Guitar website | Wiz's Security Blog | My Webmaster Services | Wiz's Security Blog
Post Reply