Sorry, Adrian, but the email that was sent out is indefensible. Number 1, it is false: You sent the message to me, claiming that I was using an outdated browser, but my browsers (both IE and Firefox) are fully up to date, as reported by both the manufacturers and Secunia, an update manager I use that alerts me if anything is out of date. Compounding that failure, www.paypal.com/safebrowser makes the exact same claim, without providing any reason for it. (The "may be using" weasel words are no excuse.) Number 2, it is structured exactly like a phishing email, asking people to do exactly what you've always told them not to do. While the fact that my name was displayed in the mail is a partial reassurance that it's valid, there's still the risk that it's a spear phishing email, which is exactly the method the Chinese recently used to break into Gmail accounts.
I haven't even logged into Paypal recently, so how would Paypal have any reason to know whether I'm using an outdated browser? It seems clear this was sent as a mass email to your entire user base, with no factual basis other than "a lot of people have outdated browsers." But that's not what the email claimed. If you'd said, "Many people have outdated browsers. Please check to make sure yours is up to date," that would be one think. But instead, you FALSELY said that all of us have outdated browsers, when you clearly have no basis for making that claim. And you encouraged people to do an action (click on a link in the email to update software) that, if repeated with other emails, puts them at risk of security compromises.
SHAME! SHAME! SHAME!
