Quick Answer: PayPal scam emails are increasingly sophisticated, with cybercriminals creating fake websites virtually indistinguishable from legitimate PayPal.com, including identical images, colors, and HTML code. OpenDNS researchers discovered phishing domains like “redirectly-paypal.com” and “x-paypal.com” that could easily fool untrained users into entering credentials.
Faked PayPal email notifications directing recipients to malicious websites aren’t new. But cybercriminals are getting a lot better at executing them.
That’s what the discovery of a current phishing campaign designed to lure victims to click to a pair of very well-designed faked PayPal websites shows.
The finding comes from researchers at OpenDNS, a free, ad-sponsored service for making faster, more secure website connections.
Each weekday I send one short email: one money story that caught my attention, why it might matter to you, and one manageable thing you can do with it. A couple of minutes, and a dad joke.
In the latest issue (Oct 9): Does Financial Literacy Make Financial Sense?
Free. I sell nothing. Unsubscribe any time.
The fraudulent PayPal websites are virtually indistinguishable from the real PayPal.com, down to the images used on the login screen, the color palette, and the HTML code used in the page’s layout, the researchers found.
The Daily Money Brief — Free, at 10 AM
Money you may be owed, scams to dodge, and the fine print decoded — the consumer money news that affects your wallet, every weekday.
The faked sites were registered through a popular web hosting service and designed using the service’s extensive site-building tools, resulting in a professional and realistic-looking site. “An untrained observer might not notice and actually follow through with entering credentials,” OpenDNS researchers wrote.
More Believable Domain Names
Even the domain names were selected to confuse victims. The phishers used site names like “redirectly-paypal.com” and “security-paypal-center.com.” One forged domain, “x-paypal.com,” was a “perfect clone of the legitimate PayPal.com site,” the researchers said.
Phishing refers to how attackers lure victims into handing over sensitive information such as user names, passwords and financial information. For the most part, phishing attacks begin with an email that appears to be from a legitimate source, whether it’s a person or a business, asking for specific pieces of information. This latest phishing campaign began with fake emails masquerading as official communications from PayPal.com.
If the recipient falls for the trick and clicks on a link in the email, the victim is directed to a website — which looks legitimate — to enter the information. The Anti-Phishing Working Group, a global consortium of companies and agencies, counted 128,378 phishing sites in the second quarter of 2014. This is the second-highest number of phishing sites detected in a quarter, topped only by the 164,032 phishing sites active in the first quarter of 2012.
While the majority of phishing attacks are not personalized and are sent to as many potential victims as possible, targeted phishing — also known as spear-phishing — also occurs. In those cases, the attacker uses information about the recipient to create an even more convincing lure.
A well-crafted targeted phishing attack can defeat even the best security controls if an attacker is able to collect highly privileged login credentials.
There are some indicators to look out for to avoid being phished, but they require careful scrutiny and a high level of alertness. The original phishing email may have some clues — such as the fact that it outright asks for the user password. Users can verify that the site is using HTTPS and a legitimate SSL Certificate. All the spoofed sites OpenDNS observed happen to use HTTP, which is not a likely situation for any site that engages in financial transactions.
“If the wording is off or it’s blatantly asking for you to enter your password somewhere, it could be phishing,” OpenDNS said.
These attacks are not new, but they are beginning to look more legitimate with every iteration. Website builders and hosts such as Wix.com make it simple to create a professional-looking website quickly. While that is great for users interested in setting up their own sites, it is also tremendously beneficial for attackers who need to conjure up sites quickly and frequently.
“The difficulty of identifying the validity of these websites visually will soon be untenable,” OpenDNS said.
Related Articles:
- How to Use Free Credit Monitoring
- The Signs Your Identity Has Been Stolen
- What to Do If You Think You’re a Victim of Identity Theft
This article originally appeared on Credit.com.
Before You Sign Anything: Run any debt relief contract through the free Contract Decoder to spot hidden fees and unfair terms. Check the company’s complaint history with the Scam-O-Meter.
Compare Your Real Options: Most debt relief companies won’t tell you about all your options — especially the ones they can’t profit from. Credit counseling has a 21-27% completion rate. Settlement resolves about 1% of enrolled debts fully. Bankruptcy has a 95% discharge rate — and protects your retirement. Take the Find Your Path quiz for a recommendation based on your actual numbers.
