Phone phishers target PayPal
Sneaky lure
Posted in Security, 7th July 2006 15:48 GMT
Watch Now : Virtual Machine Movement with Hyper-V
Hi-tech fraudsters are attempting to trick PayPal users into calling a phone number and giving over sensitive credit card account information.
The tactic follows the same patterns as a recently detected "phone phishing" attack targeting customers of the Santa Barbara Bank & Trust. The attack on PayPal shows that the approach is going mainstream.
As before, the PayPal attack with a spoofed email message that claims that the recipient's account has been the subject of fraudulent activity. Instead of seeking to persuade users to visit a bogus website, these emails urge users to phone a number and verify the details of the credit or debit card "PayPal has on file".
When potential marks dial the phone number, a recording requests that they type in their account number. The PayPal attack is more sophisticated than the Santa Barbara Bank & Trust because fraudsters attempt to verify the legitimacy of the account information they've tricked users into handing over. If incorrect card details are entered, a request for re-entry is made, further enhancing the legitimacy of the fraudulent telephone number.
The bogus number was still live on Friday afternoon, according to UK security firm Sophos, which discovered the scam. A graphic of the bogus email and a WAV recording of the automated voice message can be found here. ®
Send corrections
Data control in the cloud
The new Office Garage series:
IT infrastructure monitoring strategies
