Burned by PayPal spoof

[Rocky Raab]

Months ago, I got what appeared to be a email from PayPal asking me to confirm my password there.

I may have done so (can't recall for sure) and have since learned that such requests are all scams. Well, nothing happened - until yesterday.

My account was charged over a thousand dollars in two fake purchases, and since my PayPal account didn't have that much in it, PayPal automatically took the money from my checking account! Now THAT's overdrawn and I have bills to pay!

I immediately filed a claim at PayPal, and they have frozen the account. They are investigating. The transactions will prove to be bogus, I'm sure. But in the meantime, my checking account is fried, and I can't freeze that or it's frozen for everything, not just PayPal.

What worries me is that the two purchases were to people in England. Getting money back in cases like that can be problematic, I've heard.

Moral: don't fall for any PayPal or eBay message that asks you for anything!

[LoneWolf]

Its not just PayPal, Rocky.
I constantly get them from banks, telling me they need to udate their files. I don't give any info out financially when asked from an email. You want to know info you should already have... send me a letter.:rolleyes:

[tooldummy]

I've gotten 3 or 4 requests for Pay Pal info in the last year. I forward them to spoof@paypal.com and in every instance they have gotten back to me and it was a phony. And Rocky's right, they looked legitimate.

Anytime you get a corespondence like that, don't even open it. Go to the pay pal website and log in and see if they have sent you anything there. They warn you that is the way they communicate with you, not by E-mail. Other than reciepts for payment.

I got 2 of the E-mails thanking me for recent purchases, but they thought they were suspicious and asking me for info. Both were hoaxes also. One was for a red dress of some kind. Have you ever seen the commercial where the people were identity theft victims. If you could see me in a red dress, I think you would agree this would be an excellent example!

Sorry it happened to you Rocky.

[larryours]

Just got a local e-mail not to call or respond to any 809 area code , NEVER dial area code 809,284, and 876, if you call from the US you will apparently be chaarged $2,425 per-minute.
Scam is to return their call, refernce some family member being ill, someone arrested, died, or to let you know you've won a wonderful prize. They will keep you on the line to run up charges, as much as $ 24,100. Since 809 is located in the British Virgin Islands( The Bahamas) you will be dealing with a foreign company, your local and long distance carrier will not get involved, and it will be a real nightmare.
I'm passing this along for everyone's benifit !

[Rocky Raab]

Yup, I just got another one! This one from a bank where I don't have an account.

If you get one that purports to be from eBay or PayPal, just forward the email unopened to either spoof@ebay.com or spoof@paypal.com

I don't know what you'd do for one of these phishing scams from a bank, but erhaps they have email accounts you could forward them to, also.

[larryours]

I was just telling a friend about this and he said he had got burnt twice in the past month, for $76.00 each time, from a Telecom in Italy

[Brithunter]

Sorry to hear of this Rocky :( the payment may have gone to England but it's already headed out to Nigeria or some such African state. Why Mr Blair and his cronies insist we need those scum here is beyond the normal persons understanding, but he says they helps us. yeah right :mad:

[gumpokc]

Yup there's alot of scams and phishing going on, has been for years.

simple rule of thumb, if you do not know who it is, or even if you do know who it is, but they are askign for information by email:

go to their website (do not click a link) and correspond there with them.

some of the current crop going around are:

citibank, wells fargo, chase bank, suntrust, U.S. bank, IRS, FDIC, ebay, paypal, Federal credit union, best buy, earthlink, 1-800-flowers, send money now, and even Visa, Mastercard, and american express.

It's alot easier to spot them if you learn to read an emails header, couple that was any decent web info software (i use "sam spade" from blightly design) and it's not hard to spot them at all.

[Skyline]

I get these all the time as well......banks, eBay, PayPal.......you name it.

Personally I think it should be a hanging offense....you know on TV in the town square. I think it might slow it down a bit.

[jon lynn]

I closed my e-bay and paypal account two years ago, I still get pay-pal notices almost bi-weekly. And I get the notice: You account must be verified, please supply information. I lived with an old army buddy in Texas before I came back to Germany, he is an IP-server-programer. He fights hackers and scammers on levils that would melt our PC's. He said the scams are getting harder and harder to detect, the fakes are getting as good as the real ones. Since he can actually read all the X's and O's (like on Matrix), he can get to the root of it, but we as regular surfers, are basicly shafted.

I know it is a crock, but the European laws are iffy at best on telephone and internet scams. For example in the Netherlands, scams are common place, they send thousands of letters to every Tom, Dick and Harry outside the kingdom. I saw a news show, a German version of 20/20, they called the scammers, pretending to be dumb, and they were all cheerful, "Why yes Mr.Balh-blah, you are the offical winner of the secret Euro Drawing! We have a check for you right here for €100,000.00!

And each EC country has different laws for everything. The expensive phone scam is perfectly legal in Germany, because at the time their was no need to change any laws, and the criminals know the loop-holes and the fact that the laws are too old to keep up with todays technoligy.

I have a friend here who is a lawyer (no, really he is okay:rolleyes: ), but I showed him a letter I got from some scam in Spain, it read something like this:

Dear Mr Lynn,
You have won €1000,748.00 in a secret lottery, please keep this win confidential until we announce you as the winner. Please fill out the attached form, and we shall deposit the money in your account.
You must return 10% of the prize to our office for taxes, and handeling-transfer fee.................................more mumbo-jumbo......


But my friend Lionel Hutz, said the scam is if you sign the form and send it in as a joke, by EC law you have to pay the 10%. He said it is likely they would say their was an error, and you have won €100, but did sign an agreement to pay the handeling of the much larger sum, minus the €100 you actually did win:eek:

AND IT IS ALL LEGAL.

My wifes cousin was summering for a German lawyer, who in his free time surfed the net seeking persons making purchases on e-bay. He actually got a German woman I work with at the PX. She bought a StarWars III online from e-Bay USA, when she got the DVD she got a letter from a lawyer who has the ability to brouse e-bay somehow, but any way he sued her for €750 (about 900 bucks) for purchasing a foregin DVD, and posessing it in a country, where 20th Century Fox had not at the time established conditions of relase for Germany.

The lawyer gets to keep all the money, the German government, nor 20-C-Fox gets a cent of this. Some acient German law says a German lawyer can sue an individual for minor violations, on the spot. Back in 2748B .C. (or when ever) the lawyers had to pay tarrifs to the kingdom they were in. But the thousand year law still stands, but the lawyer doesnt have to pay anything to the state, because THAT was changed after WWII.

[TreeDoc]

Too much! :(

I see this frequently, sorry you got nailed, Rocky! I just received the PayPal one a few days ago. They use the backdrop of what appears to be a legitimate PayPal notice but I NEVER pay attention to them and I do send them to "spoof" The one I just got was asking me to confirm my password but not 2 inches from the body of the letter over on the right margin was PayPal's traditional warning that "PayPal will never ask for your password!"

Also, always look at the email address. This one was from something like paypal@intl.paypal something-something. It just didn't look right.

[Rocky Raab]

Another thing I've learned is that the spoof emails all start "Dear PayPal member" (or eBay) or "Dear card holder" or some such. They don't use your account name because they don't really know what it is unless and until you reply to the spoofmail.

At some point in time I must have fallen for it, but I don't remember when.

This morning, they reversed one of the transactions and refunded my money. I'm still waiting on the other one, but I have every hope of getting that back, too.

I'll still be out the check overdraft fee (I think) and the cost of all new checks and stuff, plus I'll have to change all my other online accounts to the new checking account AND change every stinking password I have everywhere, just to be safe.

[fabsroman]

Yep, I almost fell for one from "Wachovia". The initial webpage looked just like the Wachovia home page, but I got a little suspicious and clicked on one of the links without trying to log in, and there was nothing there. Tried another link, and there was nothing there. So, you can bet that I didn't log in to see this "important message" waiting for me.

I received something from PayPal a couple of days ago, just like TD. However, I do not have a PayPal account, so I knew it was fishy. I have received others from other banks that I do not deal with, but again, I know those are fake because I have nothing to do with those banks.

Wachovia got wind of the scam, and they put a huge warning on their homepage and they also sent out e-mails saying that they will never ask for any log in information via e-mail or ask for any personal information via e-mail.

As far as fraud is concerned, I got hit for about $60 in credit card fraud last month. I am pretty detail oriented, so I keep track of everything we buy. I noticed one charge for a little over $3 on our credit card statement that I had no record of. Went to the website shown on the credit card statement and it was for a weight loss drug. For $3 I wasn't going to say anything, but 2 weeks later there was another charge to the same place for $55. At that time, I called my credit card company and they cut off my credit card and issued me a new one. Of course, I had a bunch of automatic payments scheduled on that credit card, so it was a pain in the rear.

[skeeter@ccia.com]

A few years ago I ran an internet store. I was just getting things going well when the hacking etc hit me from India, Germany, England and Japan. It got to be such a chore for my computer security I just had to close it down. The laws only applied to the United States as far as able to do anything about it. Credit card information etc etc is what they were after so it was best to protect all and close down....I had to deal with a nephew that had his computer run from my mothers phone number. It turned out she got charges of quite a sum of money from foreign numbers that things were routed to and again there was nothing I could do about outside USA scams so I just refused to pay and have heard nothing more about it. I figured if they wanted the money that bad they would have to come see me in person.

[tooldummy]

Hey Rocky, I was just thinking. I'm pretty sure there was something on my homeowners insurance policy that covered fraud like happened to you. I'm not 100% sure, but it wouldn't hurt to check and see. I think I'll call my agent and ask, now I'm wondering.

[tooldummy]

OK, I called my agent and asked about this. Accoding to his secretary, this wouldn't be covered. Just credit card theft. But it might not hurt to ask anyway.

[Rocky Raab]

I'd probably go to jail myself if I filed a third claim to recover it all.

So far, BOTH my bank and Paypal have reimbursed me in total. So at least for the moment, I'm ahead by $996.








No, I'm not gonna do it.

[fabsroman]

Got this today in my e-mail. Funny thing is that I do not have a paypal account. Utterly incredible. These people should be shot.

Dear PayPal Member,

Our comprehensive fraud-prevention program is one of the key reasons PayPal is a safe way to pay online. We believe that innovation and careful analysis is the way to beat fraud. That's why PayPal has developed industry-leading models to review every transaction, and help detect suspicious activity.

Our Fraud Investigation Team recently detected suspicious activity in your account. In order to continue to operate the PayPal service and to reduce the risk of fraud, PayPal Corp. ("PayPal" or "we") must ask you to provide us information about yourself and your credit card and/or bank account.


-------------------------------------------------------------------------------------
To do so please follow the link below.
https://www.paypal.com/cgi-bin/webscr?cmd=_login-run
-------------------------------------------------------------------------------------

Thank you for your prompt attention to this matter. Please understand that this is a security measure meant to help you and protect your account. We apologize for any inconvenience.


Sincerely,
PayPal Fraud Investigation Department

PayPal Email ID PP562

[fabsroman]

Then again, maybe I should let them steal a bunch of money so that I can come out ahead like Rocky. If they steal $10,000, that means that I will come out $10,000 ahead. Sounds great to me. Only problem is that I might not get reimbursed by my bank or PayPal.

[Rocky Raab]

Hey Fabs, HERE's a lawyerly kind of thought...

If I shoot the guy who stole my identity - is it murder or suicide?

:rolleyes:

[Steverino]

please describe your selection criteria of cartridge utilized (I am sure that you will have some sort of a special handload in mind-hypothetically speaking, of course) as well as the gun to shoot the would be stealer of said identity and why .:D

[tooldummy]

I didn't know you had recouped your losses. I guess I should have read your posts closer.

[Rapier]

Rocky,
Sorry for the problem. I stopped using PayPal over 4 years ago when they tried to keep my court ordered restitution money. I had to go to the FBI to get my money back from PayPal.

So if you got your money back without using the justice department, you are lucky and something better must have happened at PayPal.
Ed

[denton]

That's a bummer of an experience. Sorry to hear about it.

I've had days where I've gotten six different notices that I've won various lotteries. The PayPal "confirm your details" messages come pretty regularly, along with some saying that my eBay standing is in jeapardy because of a dispute on some item that I've never heard of.

Is there some way we can get a season on these spammers? I can hardly pick my real email out from amid the incoming trash.

[gumpokc]

Denton, unless you learn how to read email headers, you'll have to rely on some sort of a software solution, ie some sort of spam blocking software.

If you learn to read the headers and what to watch for, it's pretty simpel to spot them, but does take a little time.

pnce you can read headers you can setup some of the filters in your blocking software to better suit yourself, or if you really want to get into it, there are ways to backtrack the email to a certain extant.

The thing that'll really tick you off is this..... When windows XP came out, they released it with full raw sockets ability.
basically a network testing ability that no normal user needs or will ever even hear of, but it gave windows PC's the same IP masking abilities that only unix/linux machines had prior to that.
Microsoft knew this would happen, people in those circles went on about it for months, but nicrosoft went ahead and released it anyway.

Sometimes i think they release buggy/exploit ridden software, just to keep themselves in business "fixing" what should have never existed in the first place.

the second thing that really get your goat, is about 1997 or 98 there was a big push for _ALL_ mail servers to have a small bit of code added (less than 20 min for any halfass coder to do) that would have made spam, as we see it today, impossible.
Yes soem would have still be around, but not the way it is.

BUT noone wanted to do it, because it "wasen't their problem".

[Drew_CarreyAB]

I too was hit with this Pay-Pal crap......I got a call saying that someone had tried to take $ out of my bank account through Pay-Pal (It was lucky that I didn't have any $$ in the account). I got charged an NSF fee from my bank and from my other institutions(Insurance and the like) for not having sufficient funds. I called the office in the states and they put a freeze on the account and were going to look into it.....I wish they would give the scammed all the info they find on the scammers, it would be nicer that way(wink, wink) to deal with the problem IMHO.

[Rocky Raab]

It looks like I'll finally have it all sorted out soon.

Actually, PayPal and my bank were both VERY helpful. Both parties have an active anti-fraud forces, and they both jumped on it in my behalf. I've since gotten all the transactions reversed, and I'm essentially back to where I started, money-wise.

BUT - and here's the head-banging, frustrating, sleep-losing half of the equation: I had to close several bank accounts, get new ones, pay for all new computer-fed checks, change (and endlessly explain WHY) all my merchant accounts (credit card acceptance, bill paying, online sales, etc and endless etc). It's taken DAYS of doing little BUT this crap. In the meantime, I had bills come due - and no way to pay them either online or with still-to-arrive checks. Try explaining that to creditors over and over again!

It's a goldurn nightmare.

[denton]

On the lighter side, there are several groups of people who delight in taking revenge on the scammers.

Probably the most hilarious happened with the familiar "we will give you a nice bribe if you will help launder some money" scam out of Nigeria.

The intended victim wrote back that he was the financial officer of a monastic religious order, and he was sure he could help them out, and that the profit would be a great blessing to the monastery, since it was in need of repairs.

Well, that got the scammer going... would he please send the necessary $30,000 processing fees, etc.

The victim wrote back that he was required to do business only with good Christian people, which the scammer assured him that he was. Then the victim got his revenge:

It seems that the order was founded by Sister Jones, a missionary in darkest Africa. Members of the order are required to strip to the waist, and paint a large 9 on their chest. Would the scammer please take the necessary oath, and provide a photo of himself properly painted? Yes, he would. Back came the required photo.

Very good! By the way, our victim showed the photo of the scammer to the Widow Smith, who finds him quite attractive. Would he be interested in a connection, with matrimony in mind? Well, no. At this point the victim acted very indignant, and led the scammer in a merry dance. Prejudice, you know.

Oh... the money? Well, of course, no problem. But, you see the order takes vows of poverty, and... well... would the scammer mind sending $80 to cover the withdrawal costs? And the scammer did. Victim quietly donated it to charity.

Pretty quick, the scammer is back, demanding to know where his money is. The victim then writes back in the persona of his supervisor, asking the scammer if he has any idea where the victim is. Seems that $30,000 is missing from the monastery's account, and the victim was last seen leaving town in the company of a Gypsy woman....

I can't tell it as well as the original victim, but by the time I was done reading it, I had tears rolling down my cheeks.... sweet revenge.

[indianahick]

[Dear PayPal Member,

Our comprehensive fraud-prevention program is one of the key reasons PayPal is a safe way to pay online. We believe that innovation and careful analysis is the way to beat fraud. That's why PayPal has developed industry-leading models to review every transaction, and help detect suspicious activity.

Our Fraud Investigation Team recently detected suspicious activity in your account. In order to continue to operate the PayPal service and to reduce the risk of fraud, PayPal Corp. ("PayPal" or "we") must ask you to provide us information about yourself and your credit card and/or bank account.


-------------------------------------------------------------------------------------
To do so please follow the link below.
https://www.paypal.com/cgi-bin/webscr?cmd=_login-run
-------------------------------------------------------------------------------------

Thank you for your prompt attention to this matter. Please understand that this is a security measure meant to help you and protect your account. We apologize for any inconvenience.


Sincerely,
PayPal Fraud Investigation Department

PayPal Email ID PP562

I got that message also. Hit reply and told them that I did not believe in letting anyone have my bank accounts and secondly I was not a member of pay pal. Drop dead.

[skeeter@ccia.com]

I like the outcome of Dentons story...wonder if they can get us for scamming them back?....Seems they say if outside the States, nothing they can do for you...so wonder if that works both ways?...

[Rocky Raab]

I'm sure your reply made you feel good, but it also told them that the email addy they sent that spoof to is a valid one.

Prepare for an onslaught of "body enhancement", investment, prescription and other bogus things in your inbox, my friend. Because if they can't fool you with the scam, they'll sell your valid email addy.

NEVER reply. But DO forward such things to spoof@paypal.com (or spoof@ebay.com)

[gumpokc]

Agreed Rocky, also Indy, nevr _EVER_ go to a link inside any email you suspect as bogus.

as a matter of fact, even if you think it is legit, always go to the site in question manually, IE go to paypal.com, then login etc, never _EVER_ use a shortcut link.

The reason being is that many of the scammers/spammers, are also distributing viri, trojans and rootkits.

By even simply going to the page in their spoofmail you put yourself at risk for java/active-x applications installing things without your knowledge.

Yes i know there are ways to protect yourself to "some" extant against those, but, the best prevention is not to expose yourself in the first place.