Spoof Happens
--------------------------------------------------------------------------
Even Savvy Shoppers can Fall Victim to Email Spoofs
Anna Rorick is a tech-savvy person. She does most of her buying online, so she stays on top of the latest news about email fraud. “I always have the spoof radar running,” says Anna. “I update my antivirus stuff, change passwords, and follow the news about scams.” So it was a shock when Anna realized she’d fallen for one. “It really can happen to anyone!” says Anna. “I was caught off guard.”
What Happened to Anna
Anna received an email that said it was from a retailer she’d shopped with for years. “Ordinarily, I would have been more careful, but I’d just spent hours dealing with that store the day before, so I fell for it.”
Just the previous day, Anna had purchased several items from different vendors through that retailer. Unfortunately, her purchases were charged to an expired card, and Anna had to work with each vendor individually to complete her orders. “With PayPal, I wouldn’t have had to keep track of the information shared with all those different merchants.”
The spoofer had perfect timing. The email said, “due to recent activity, we’re doing a safety check on your account,” and asked Anna to click a link and enter her username and password on a website. Given the previous day’s events, she did.
Anna Realizes Her Mistake
“Later it dawned on me,” Anna says. “That’s a classic spoof tactic.” She notified the retailer of the spoof and changed the password on her account. Fortunately, there hasn’t been any fraudulent activity. Anna’s relieved, but remains on alert. “Even someone who’s knowledgeable can be fooled.”
After her experience, Anna appreciates the fact that merchants never see her financial information when she pays with PayPal. “I now realize the value of this protection.” She also signed up for the free Equifax credit alert service, available to PayPal users, to notify her of any activity on her credit report. “It makes me feel a lot safer,” Anna says, “knowing I’ll hear about anyone trying to open new accounts in my name.”
Read the Q&A with Dave Steer of PayPal’s Consumer Safety team.
What Anna Learned: Tips to Avoid Being Spoofed
Be aware – spoofers often use fake email addresses that look like they’re from your bank, major retailers, and even PayPal to fool you into revealing your password and financial information.
Look out for any email that starts with something like “Dear PayPal user” or “valued customer,” instead of your name.
Be wary of emails asking you for personal information such as:
Credit and debit card numbers
Bank account numbers
Driver’s license numbers
Email addresses
Passwords
Your full name
Never give out your username or password on a site you’ve clicked through to from an email – especially if the email uses a false sense of urgency about your account being closed or your credit cards expiring.
Instead, if you doubt the authenticity of an email from a trusted vendor, simply open a new web browser, type in the URL by hand, and perform the requested activity.
Look closely at any email about updating your account, password, or credit card numbers. Spoofers use tricks like these to get you to respond. See an example of a spoof email.
Visit the PayPal Anti-Spoof page for more information.
Spoof Happens
--------------------------------------------------------------------------
Even Savvy Shoppers can Fall Victim to Email Spoofs
Anna Rorick is a tech-savvy person. She does most of her buying online, so she stays on top of the latest news about email fraud. “I always have the spoof radar running,” says Anna. “I update my antivirus stuff, change passwords, and follow the news about scams.” So it was a shock when Anna realized she’d fallen for one. “It really can happen to anyone!” says Anna. “I was caught off guard.”
What Happened to Anna
Anna received an email that said it was from a retailer she’d shopped with for years. “Ordinarily, I would have been more careful, but I’d just spent hours dealing with that store the day before, so I fell for it.”
Just the previous day, Anna had purchased several items from different vendors through that retailer. Unfortunately, her purchases were charged to an expired card, and Anna had to work with each vendor individually to complete her orders. “With PayPal, I wouldn’t have had to keep track of the information shared with all those different merchants.”
The spoofer had perfect timing. The email said, “due to recent activity, we’re doing a safety check on your account,” and asked Anna to click a link and enter her username and password on a website. Given the previous day’s events, she did.
Anna Realizes Her Mistake
“Later it dawned on me,” Anna says. “That’s a classic spoof tactic.” She notified the retailer of the spoof and changed the password on her account. Fortunately, there hasn’t been any fraudulent activity. Anna’s relieved, but remains on alert. “Even someone who’s knowledgeable can be fooled.”
After her experience, Anna appreciates the fact that merchants never see her financial information when she pays with PayPal. “I now realize the value of this protection.” She also signed up for the free Equifax credit alert service, available to PayPal users, to notify her of any activity on her credit report. “It makes me feel a lot safer,” Anna says, “knowing I’ll hear about anyone trying to open new accounts in my name.”
Read the Q&A with Dave Steer of PayPal’s Consumer Safety team.
What Anna Learned: Tips to Avoid Being Spoofed
Be aware – spoofers often use fake email addresses that look like they’re from your bank, major retailers, and even PayPal to fool you into revealing your password and financial information.
Look out for any email that starts with something like “Dear PayPal user” or “valued customer,” instead of your name.
Be wary of emails asking you for personal information such as:
Credit and debit card numbers
Bank account numbers
Driver’s license numbers
Email addresses
Passwords
Your full name
Never give out your username or password on a site you’ve clicked through to from an email – especially if the email uses a false sense of urgency about your account being closed or your credit cards expiring.
Instead, if you doubt the authenticity of an email from a trusted vendor, simply open a new web browser, type in the URL by hand, and perform the requested activity.
Look closely at any email about updating your account, password, or credit card numbers. Spoofers use tricks like these to get you to respond. See an example of a spoof email.
Visit the PayPal Anti-Spoof page for more information.
https://www.paypal.com/cgi-bin/webscr?cmd=xpt/cps/general/SpoofHappen-outside
), but I only focus in the first return field. Do you notice why it didn't say "paypal.com" in my header? It's because somebody have tried to get me to think that the e-mail came from PayPal, but no matter how hard they try, I can never be fooled and my chance of being fooled are almost at 0%--maybe 0.1% as I can't be so sure about that...