Got an email from "info.Paypal.com" and know is a scam!

[bowzerbird]

Hi Guys, new here,

Been using Paypal for a few years and am computer literate when it comes to phishing scams & ID theft. A few days ago, got an email from "info.paypal.com" and knew it was a scam. Sent the message source to spoof@paypal.com and they confirmed it was a phishing attempt [quote <> You're right - it was a phishing attempt, and we're working on stopping the fraud. By reporting the problem, you've made a difference! end quote].

The email had my first & last name in it that "gave" the impression it was from Paypal. The "info" in the addy WAS the give-away of the scam. Having my name was rather scary and I emailed Paypal again asking HOW they could have gotten my name in the first place!! Didn't get a satisfied answer, so, I called Paypal. We discussed a few possibilities of how my name was acquired in the first place. I contributed most of the "speculations" as to how:

The main way I think it was acquired is this: Let's first create a scenario:

You buy something on eBay. The transaction goes through Paypal. The seller ONLY has your Name <> email addy <> and physical address to ship the item to that you bought from them.

Paypal has ALL your banking / credit card info: the seller you bought from on eBay [or where ever] does NOT! BUT they have your email addy AND your name, so  .  .  .  .  they send you an email with all the Paypal graphics to make it look "legit" and use a "spoofed-email addy" AND website to either reply to or go to the website [from links in the email] AND fill in "forms" that will ask for credit card <> bank <> username <> password info.

Getting beyond my LONG  wind here, can anyone help me and confirm that this is possibly the way they got my name to begin with in the first place???

Also, can you suggest ANY OTHER way[s] these phishers get our full names?

It would truly help ALL of us in avoiding these scams & phishing attempts in the future. Please, can you give me a more inclusive answer then I received from either the spoof@paypal.com email or the Paypal phone call I made. I just want to know HOW they got my full name in the first place.

Thank you in advance AND I truly mean that sincerely,

Ellen

[tservers]

They're probably getting your info from a mailing list or something else, and as long as they have a person's full name and email address, they simply take the chance to see if you'll bite the bait trap they set.

In other words, anyone can send an email to any email address with that person's full name and make it look like it's actually coming from PayPal.

The main thing is to NEVER click on the links in those emails.

Also, if you use Gmail, odds are that the bogus emails will go to your SPAM box instead of your inbox.

[bowzerbird]

Hey thanks for the quick reply. Interestingly, Paypal has a free software download program that automatically recognizes legitimate Paypal emails. It's called, "truemark Email ID" from Iconix. Unfortunately, at this time it cannot be used with Thunderbird which is my email client.

I'm computer savvy enough in regards to ID theft and malware issues having taught virus [malware] & ID theft prevention classes but just wanted to have Paypal tell me how this company got my entire name. Guess I'm on some mailing list out there SOMEWHERE. Oh foowee. Will have to "heighten" my paranoia level up a notch or two  .   .   .   defcon 4

Thanks again,

Ellen

[njride]

The situation is not as simple as you describe. I also got these phishing emails from info.paypal.com (a 3rd one this morning, in fact). This what I wrote to PayPal:

"I am very disturbed by this phishing email because <MY EMAIL ADDRESS> is a very recently established email address which I have used ONLY for PayPal and official Ebay purposes. I hope this information will help you track down the source of this breach."

My real name could not have been deduced from my email address, so we're not dealing with a mailing list or random attack. 

[bowzerbird]

---

@njride wrote:

The situation is not as simple as you describe. I also got these phishing emails from info.paypal.com (a 3rd one this morning, in fact). This what I wrote to PayPal:

"I am very disturbed by this phishing email because <MY EMAIL ADDRESS> is a very recently established email address which I have used ONLY for PayPal and official Ebay purposes. I hope this information will help you track down the source of this breach."

My real name could not have been deduced from my email address, so we're not dealing with a mailing list or random attack. 

This is my theory:

When you buy from eBay, the seller does have your <>name<> <>email addy<> and delivery address. Not banking / / or credit card info. So, if they're "shady" even though they may have stars for approval ratings, they can establish a fake email addy [a spoofed addy] and email info to you to from, "supposedly" Paypal.

ALWAYS mouse over the return addy and you'll find is NOT from Paypal. So don't be tricked by the Dear [your real name] in the salutation. That eBay seller already HAS your name!!

Hope this helps,

Ellen

[njride]

Guess what. It turns out that these emails from <info.paypal.com> are NOT phishing emails after all (at least the few that I received). Even though my gmail flagged it as spam and "phishing," this is the response I got from paypal.com after forwarding to them the suspect email:

"Thank you for bringing this email to our attention. We can confirm that PayPal sent this email. We apologize for any confusion this may have caused.
To keep members informed of our products and services, PayPal occasionally sends emails to account holders. General Notification emails and Payment Notification emails are activated by default. Therefore, a PayPal user will need to set their Preferences to 'not' receive these emails if they so choose..."

[bowzerbird · Accepted solution]

Yes, you're correct. I got an email from Paypal stating that YES!! the original one thinking it was spam / phish etc. was not and was legit from them.

Hey, great news it was real!

Thanks,

Ellen

[cqui]

At any rate, I go straight to the website and check it out! Today I recieved an email saying paypal send me $257.00, click this link to find out more. First of all I know paypal sent me nothing. They can't unless I go in and request it. Further more there is no transaction for that amount. The balance is still zero. What fools!