Paypal Scam????

(RIP) Geriatric Germ · Mar 1, 2005

Just had this Email, any comments please??? Looks dodgy
:confused:

X-Apparently-To: [email protected] via 217.12.12.64; Tue, 01 Mar 2005 06:06:50 +0000
Authentication-Results: mta815.mail.ukl.yahoo.com
from=paypal.com; domainkeys=neutral (no sig)
X-Originating-IP: [128.123.3.4]
Return-Path: <[email protected]>
Received: from 128.123.3.4 (EHLO joebob.NMSU.Edu) (128.123.3.4)
by mta815.mail.ukl.yahoo.com with SMTP; Tue, 01 Mar 2005 06:06:50 +0000
Received: from joebob.NMSU.Edu (localhost [127.0.0.1])
by joebob.NMSU.Edu (8.12.10+Sun/8.12.0) with ESMTP id j2166mcB005129
for <[email protected]>; Mon, 28 Feb 2005 23:06:48 -0700 (MST)
Received: (from nobody@localhost)
by joebob.NMSU.Edu (8.12.10+Sun/8.12.9/Submit) id j2166mIu005128;
Mon, 28 Feb 2005 23:06:48 -0700 (MST)
Date: Mon, 28 Feb 2005 23:06:48 -0700 (MST)
Message-Id: <[email protected]>
To: [email protected]
Subject: Case ID Number: PP-332-182-001
From: "[email protected]" <[email protected]>
Reply-To: [email protected]
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: 8bit

<HTML>

<A href="http://www.paypal.com/cgi-bin/webscr?cmd=_home">
<IMG src="http://images.paypal.com/en_US/i/logo/email_logo.gif" border=0 width="256" height="36"></A>

Dear PayPal® Member: 
 

 
Recently, our Account Review Team identified some unusual activity in your 
account. In accordance with PayPal's User Agreement and to ensure that your 
account has not been compromised, access to your account was limited. Your 
account access will remain limited until this issue has been resolved. This 
is a fraud prevention measure meant to ensure that your account is not 
compromised. 
 
In order to secure your account and quickly restore full access, we may 
require some specific information from you for the following reason: 
 
We would like to ensure that your account was not accessed by an 
unauthorized third party. Because protecting the security of your account 
is our primary concern, we have limited access to sensitive PayPal account 
features. We understand that this may be an inconvenience but please 
understand that this temporary limitation is for your protection. 
 
Case ID Number: PP-332-182-001 
 
We encourage you to log in and restore full access as soon as possible. 
Should access to your account remain limited for an extended period of 
time, it may result in further limitations on the use of your account.</tt> 
However, failure to restore your records will result in account suspension. Please update your records on or before March 5, 2005. Once you have updated your account records, your PayPal session will not be interrupted and will continue as normal. 
Please update your 
Paypal record: <A href="http://202.29.80.159/.paypal/skmpp/" target=_self>https://www.paypal.com/cgi-bin/webscr?cmd=_login-run</A>
 

<tt>Thank you for your prompt attention to this matter.
Please understand that 
this is a security measure meant to help protect you and your account. We 
apologize for any inconvenience. 
 
 
Sincerely, 
</tt>
PayPal®
Account Review Department<tt> 
 
 
 
PayPal Email ID PP181 

</tt> 
Accounts Management As outlined in our User Agreement, 
PayPal will periodically send you information about site changes and enhancements. 
Visit our Privacy Policy and User Agreement if you have any questions. <A href="http://www.paypal.com/cgi-bin/webscr?cmd=p/gen/ua/policy_privacy-outside">http://www.paypal.com/cgi-bin/webscr?cmd=p/gen/ua/policy_privacy-outside</A>
 </FORM></BODY></HTML>
<DIV>

We would like to ensure that your account was not accessed by an
unauthorized third party. Because protecting the security of your account
is our primary concern, we have limited access to sensitive PayPal account
features. We understand that this may be an inconvenience but please
understand that this temporary limitation is for your protection.

Case ID Number: PP-332-182-001

We encourage you to log in and restore full access as soon as possible.
Should access to your account remain limited for an extended period of
time, it may result in further limitations on the use of your account.
However, failure to restore your records will result in account suspension.
Please update your records on or before March 5, 2005.

Once you have updated your account records, your PayPal session will not be
interrupted and will continue as normal.
Please update your Paypal record:
https://www.paypal.com/cgi-bin/webscr?cmd=_login-run [links to http://202.29.80.159/.paypal/skmpp/]

Thank you for your prompt attention to this matter. Please understand that
this is a security measure meant to help protect you and your account. We
apologize for any inconvenience.

Sincerely,
PayPal® Account Review Department

Steve · Mar 1, 2005

rcc54 said:
Just had this Email, any comments please??? Looks dodgy

ANY email that asks for account details is a scam. Enough said?

Jezza · Mar 1, 2005

rcc54 said:
Just had this Email, any comments please??? Looks dodgy

Please update your Paypal record:
https://www.paypal.com/cgi-bin/webscr?cmd=_login-run [links to http://202.29.80.159/.paypal/skmpp/]

Its a Scam, the clue is where the link actual hyper link really goes to, not the text that shows on the top.

So it looks like it goes to https://www.paypal.com/cgi-bin/webscr?cmd=_login-run
but by looking at the scouce code of the email it is actually going to http://202.29.80.159/.paypal/skmpp/

(RIP) Geriatric Germ · Mar 1, 2005

Thanx for the prompt replies

Me luddite, but the Links all seem to go to Paypal Web Site, I haven't actually opened the mail yet, as I previewed it using Mailwasher. I recently withdrew money from Paypal for sold Ebay items and money transferred to my bank account OK. So I don't really understand it :confused:

but will just delete and ignore. Thanks again.

Paul G (BHT) · Mar 1, 2005

Also one to note, Paypal will always address you by name and not Sir, Madam, member etc

Droopy Dick · Mar 1, 2005

Forward the e-mail to PayPal.

They take these things very seriously and use legal means to track down the scammers.

Clive795 · Mar 1, 2005

The headers on this mail show it coming from New Mexico State University !,
It appears to have been routed through the internal mail server then out through their SMTP server.

Its likely that the real sender has just exploited a security weakness at the University to send out thousands of these mails using their mail server.

Clive

AndyT · Mar 2, 2005

I get at least 5 or 6 of these a week and just bin them all. I had one last week from someone in the US Military of all places. I thought they were all out in Iraq??

AndyT

longdog · Mar 2, 2005

Any GENUINE PayPal e-mail ALWAYS addresses you by your first and second names. Any e-mail which adresses you by "Dear Member" or similar is a scam! PayPal ask you to forward ANY e-mails like this to [email protected]

Paypal Scam????

(RIP) Geriatric Germ

Registered user

Steve

Registered user

Jezza

Registered user

(RIP) Geriatric Germ

Registered user

Paul G (BHT)

Janitor

Droopy Dick

Registered user

Clive795

Registered user

AndyT

Well-known member

longdog

Well-known member

Similar threads