KB 206

I just got an email message asking for my credit card number, should I give it to them?

Article:206
Created:2003-04-18 12:10:00
Categories:
  Security

Question or Symptom

Warning: there is a current email scam going around masquerading as a message from security@paypal.com and directing you to a web site that asks for all kinds of credit information. The following is a announcement explaining how this scam is working.

Resolution

From: Paul Zasada <Communication@InfraGard-CT.org>

To: InfraGard_Discussion <InfraGard-Discussion@listserv.infragard.org>

Subject: [Infragard-discussion] Warning: Paypal account update spoof...

Date: 18 Apr 2003 11:42:33 -0400

Beware of an urgent email from security@Paypal.com to update your account...

"It has come to our attention that your eBay Billing Information records are out of date. That requires you to update the Billing Information. If you could please take 5-10 minutes out of your online experience and update your billing records, you will not run into any future problems with eBay's online service. However, failure to update your records will result in account termination. Please update your records in maximum 24 hours."

The link provides a web page that requests: username/password/email, creditcard/CCV, bank account/ABA... whole 9 yards. The presentation is extremely convincing, with Paypal graphics deep-linked from official Paypal servers and all links programmed to show the Paypal.com URL in the browser status window on mouseover.

The webpage requesting update of info is not an SHTTP page (ssl) and the URL is a numerical IP to mask the identity, which goes to a bogus "elemantary" school in Korea: http://211.34.252.132/

FBI Cybercrime Division confirms this is a new scam that is similar to one which masqueraded as AOL and several other online service providers. If you receive email that provides a link with a destination page requesting personal information, you should be very suspicious. Generally, you should never give out personal information unless you go to that service provider's site and physically log into your account with your user-name and password.

Please feel free to circulate this to anyone that can benefit.

Paul Zasada Communications Director FBI InfraGard Connecticut http://www.InfraGard-CT.org