PayPal users beware of holiday phishing scam

The holiday shopping season means more people making more online purchases -- a prime opportunity for phishing scams

With Black Friday quickly approaching, and retailers racing to outdo each other with earlier and earlier deals, it is safe to say that the holiday shopping season has begun. If you're shopping online, though, and paying with PayPal -- be warned. There is a phishing attack targeted just for you.

The holidays come with a dramatic spike in shopping, and nobody appreciates the increase in online commerce more than cyber criminals. While you're preparing for a Thanksgiving celebration of beer and watching the Detroit Lions make a mockery of professional football...Hey, don't judge. You try supporting a team that has been consistently sad for 60 years and see if you aren't a little bitter. Fine. While you're preparing for a traditional Thanksgiving feast and plotting your Black Friday shopping strategy, malware developers are hard at work finding ways to capitalize on the shopping season.

PayPal is established as a leading method of online payments. It is an integral part of eBay purchasing -- a very popular way to acquire gifts during the holiday season, and it is widely accepted as a method of payment by online retailers of all sorts. It makes sense that cyber criminals would try to capitalize on the spike in PayPal transactions to catch naïve or unsuspecting users off guard.

AppRiver's Troy Gill has uncovered just such a scam. "Since so many people use PayPal in conjunction with the impending holiday shopping spree, scammers are looking to take full advantage of unwary consumers. The latest PayPal related scam targets PayPal users via email. Unlike most of the PayPal scams that we have seen in the past that included a link in the body of the message, these have an attached HTML. When the attachment is clicked a Java Script will produce a Phishing page that mimics a legitimate PayPal page. The input information is then sent off to another domain that will make it available for the cybercriminals."

As Gill notes, this attack attempts to dupe victims by using an attachment as opposed to a link. Granted, users should be conditioned to avoid both links and file attachments in suspicious or questionable e-mails, but just switching things up from the normal malicious URL might be enough to snare some unwary users.

Once the attackers have the PayPal credentials entered on the spoofed PayPal page, they can transfer the funds out of the PayPal account, make purchases using the money in the PayPal account, request funds to be sent to the PayPal account, or anything else the legitimate account holder is normally able to do with a PayPal account.

Most avid PayPal customers hopefully know better than to fall for such a thing, but with the holidays and the spike in online shopping comes a deluge of newbies who know enough to use PayPal to make purchases, but aren't seasoned in how to protect it.

Gill warns, "During the next few months you should be aware that you will be a broader target for scammers looking to take advantage of your increased purchasing activity. Since most people will be making a far greater number of purchases on their credit cards around the holidays they would be less likely to notice fraudulent activity on their cards."

Just remember the mantra that common sense and cautious skepticism will prevent almost all attacks. Happy Holidays!

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Tags online securityspamantispamvirusessecurityshoppingpaypalphishing

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Tony Bradley

PC World (US online)
Show Comments

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?