Timeline of a scam
I received this email about eight yesterday morning to my work account. It’s obviously a scam, but it is a legitimate email coming from PayPal. Correct name, all the links check out. Hm.
First thing I did was search that phone number – it’s obviously the heart of the scam. Sure enough, the first person ever to go looking for that number was two hours earlier. He got exactly the same message, but with a different senders’s name.
Here is the lookup page. I’m the seventh commenter down. At that time, the number had been searched around twenty times.
As of now, the number has been looked up 338 and 42 people made remarks. The messages are kind of interesting. A couple of people called the number and played along (dangerous – there are numbers that automatically charge you a bunch of money when you connect to them). Some people called PayPal.
Oh, yes – I checked the work PayPal account and this message was in it, verbatim, with the proposed transaction. I cancelled it, natch.
Here’s what happened. Let’s say I’m your gardener and I do 5 hours of shitty, lazy gardening for you at £10 an hour. If I know your account address, PayPal has a function where I can send you a message that says, “hello, Yourname. Please send me £50 for my crappy product. Love, Stoaty.” Which seems a reasonable sort of function to have.
Unfortunately, the message can also say, “FRAUDULENT TRANSACTION FOUND IN YOUR ACCOUNT OF 890. 00 GBP, TO STOP OR CANCEL THIS AMOUNT CALL US IMMEDIATELY @ +44-800-058-4853 OR THE AMOUNT WILL BE DEBITED WITHIN 12 HOURS’ and there really isn’t a way for PayPal to tell the difference. They’re well aware of it now (they got an earful yesterday) but I’m not sure what they can do but get rid of that feature.
Oh, look – I’ve just received a less interesting phishing email that *almost* passed the smell test, but the “refund here” button links to something called rebrand.ly and stoaty@sweasel.com doesn’t have a PayPal. Nice try, assholes!
BTW, the correct reporting address is phishing@paypal.com.
November 29, 2022 — 4:57 pm
Comments: 8