Tuesday, 3 January 2006

Give a man a phish you feed him for a day...

I've been doing a lot of shopping over the internet since I got here; mainly books but a few other things too. Bloomington doesn't have a lot of stores, and the campus bookshop is useless. It's very easy to do here as Froogle allows you to find the best price.

Then last night I got an email receipt from PayPal saying I'd sent someone $395.85 for a watch, which I knew nothing about! I assumed someone had got into my account and sent the money without me knowing, so I went to stop the transaction. But the link I clicked on from the email didn't take me to the real PayPal site, I took me somewhere else with an identical façade, hoping I'd enter my password on their site. Luckily, I noticed the wrong URL before I gave them any info! They hadn't broken into my account at all, they just knew I'd rush to stop them and perhaps not notice anything suspicious while in such a panic.

So everything is fine after all. I forwarded the con email to the people at PayPal; hopefully there's something they can do to stop them. I guess the moral is: when clicking on links, always look at where they're taking you.

1 comment:

Anonymous said...

Hi Nick.

I'm sorry to say that this I take as fact from watching Judge Judy, but fact nonetheless.

I believe that this falls under the FBI's jurisdiction, classified as internet fraud. This umbrella of crimes includes false advertising on eBay.

Now then, that out of the way.

Thank goodness for your diligence and thank you for sharing this. One has to ask nonetheless how it came that this email was sent to you. If it was sent to your Yahoo! account then it's most probably phishing but if it was sent to another then it becomes more likely to be someone observing your email address in use with Paypal. Have you done any of your paypal transactions using a Windows computer? There does exist software similar to spyware for Mac, LimeWire pays a fair bit of attention to what users in general type in to search for, one would hope that's all, but one thing is clear and pleasing. The system works, if the email was received at one of your more obscure email addresses - one at a university, then it's less likely to be phishing but whatever means was used only allowed them to find your email address.

Heard this story often.

The only part which doesn't have a happy ending is the fact that you clicked on the link. You stopped before any information was sent but after that URL was executed - it's in the execution of a URL within an email that SPAMmers confirm that the email address in their list runs hot, checked often. Sadly that's now a tainted address. I'd love to hear that you don't end up receiving any SPAM at that address, let us know.

Clicking on that link does *not* allow anyone to access your computer, you use a Mac, and websites don't control computers, people or software do.