Feeds

PayPal update email 'violates own anti-phishing advice'

Oopsie

Choosing a cloud hosting partner with confidence

PayPal UK has sent out an updated user agreement email to its customers that manages to violate its own tips on how to avoid phishing scams. The payments process outfit disputes the accusation.

The message - sent out on Tuesday - bears one of the hallmarks of classic phishing emails by encouraging users to click on a link to visit email0.paypal.com (instead of visiting the main paypal.co.uk site directly) to review updated terms of business. Reg reader Ian, who forwarded us a copy of the offending missive, said the message fell foul of one of seven of PayPal's own tips for avoiding phishing scams, suggesting that visiting sites directly by typing an address into a browser is more reliable than following links in emails.

The page linked to in PayPal's email does not request a user's login credentials, but even so clicking on email links to visit sites rather than typing in a URL or using bookmarks is a bad habit. PayPal should perhaps take its own Can you spot phishing? pop quiz designed to educate users on internet safety.

Helpful hints from PayPal

We asked PayPal to comment on the email, which it confirmed was genuine. Having reviewed the email, PayPal said it doesn't think there is anything wrong with it, and denies accusations that it has violated its own anti-phishing advice.

PayPal does not advise people not to click on links in emails, rather to exercise caution. Users are advised to check the URL of any link to make sure it does not direct them to something unexpected, as you know they can do this by hovering their mouse over the link.

If the link appears suspicious in any way, the advice is to open a new browser window and type the correct address in. The email sent out to customers also includes this, saying users can type paypal.co.uk into a new browser window as an alternative to clicking the link.

Expecting end users to decide whether or not a link in an email is suspicious is, in our opinion, potentially asking for trouble. It would be better for PayPal to stick to its original advice of asking users to type in a URL rather than following links.

Banks and financial services are fond of lecturing customers about the perils of phishing emails - fraudulent messages that try to trick potential victims into handing over their login credentials to fraudulent sites. Sending out emails themselves that invite users to click on an email link somewhat undermines this good work.

PayPal's email security practices have a history of confusing even its own staff, on at least one occasion. Last December we reported how eBay's payment services staffers responded to a complaint about the inclusion of a link in an email from PayPal by treating its own email - which it acknowledged was "suspicious-looking" - as a phishing attack.

"Not even PayPal support can tell the difference between a legitimate PayPal email and a phishing attack," Randy Abrams, director of technical education at anti-virus firm Eset and recipient of the offending email, noted.

PayPal is one of the principal targets of phishing attacks, so it might be a good idea for it to avoid including links to login pages in genuine communiques, a practice many online banks would also do well to apply. ®

Internet Security Threat Report 2014

More from The Register

next story
FYI: OS X Yosemite's Spotlight tells Apple EVERYTHING you're looking for
It's on by default – didn't you read the small print?
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Edward who? GCHQ boss dodges Snowden topic during last speech
UK spies would rather 'walk' than do 'mass surveillance'
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
China is ALREADY spying on Apple iCloud users, claims watchdog
Attack harvests users' info at iPhone 6 launch
Carders punch holes through Staples
Investigation launched into East Coast stores
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.