Feeds

PayPal update email 'violates own anti-phishing advice'

Oopsie

Build a business case: developing custom apps

PayPal UK has sent out an updated user agreement email to its customers that manages to violate its own tips on how to avoid phishing scams. The payments process outfit disputes the accusation.

The message - sent out on Tuesday - bears one of the hallmarks of classic phishing emails by encouraging users to click on a link to visit email0.paypal.com (instead of visiting the main paypal.co.uk site directly) to review updated terms of business. Reg reader Ian, who forwarded us a copy of the offending missive, said the message fell foul of one of seven of PayPal's own tips for avoiding phishing scams, suggesting that visiting sites directly by typing an address into a browser is more reliable than following links in emails.

The page linked to in PayPal's email does not request a user's login credentials, but even so clicking on email links to visit sites rather than typing in a URL or using bookmarks is a bad habit. PayPal should perhaps take its own Can you spot phishing? pop quiz designed to educate users on internet safety.

Helpful hints from PayPal

We asked PayPal to comment on the email, which it confirmed was genuine. Having reviewed the email, PayPal said it doesn't think there is anything wrong with it, and denies accusations that it has violated its own anti-phishing advice.

PayPal does not advise people not to click on links in emails, rather to exercise caution. Users are advised to check the URL of any link to make sure it does not direct them to something unexpected, as you know they can do this by hovering their mouse over the link.

If the link appears suspicious in any way, the advice is to open a new browser window and type the correct address in. The email sent out to customers also includes this, saying users can type paypal.co.uk into a new browser window as an alternative to clicking the link.

Expecting end users to decide whether or not a link in an email is suspicious is, in our opinion, potentially asking for trouble. It would be better for PayPal to stick to its original advice of asking users to type in a URL rather than following links.

Banks and financial services are fond of lecturing customers about the perils of phishing emails - fraudulent messages that try to trick potential victims into handing over their login credentials to fraudulent sites. Sending out emails themselves that invite users to click on an email link somewhat undermines this good work.

PayPal's email security practices have a history of confusing even its own staff, on at least one occasion. Last December we reported how eBay's payment services staffers responded to a complaint about the inclusion of a link in an email from PayPal by treating its own email - which it acknowledged was "suspicious-looking" - as a phishing attack.

"Not even PayPal support can tell the difference between a legitimate PayPal email and a phishing attack," Randy Abrams, director of technical education at anti-virus firm Eset and recipient of the offending email, noted.

PayPal is one of the principal targets of phishing attacks, so it might be a good idea for it to avoid including links to login pages in genuine communiques, a practice many online banks would also do well to apply. ®

The essential guide to IT transformation

More from The Register

next story
Rupert Murdoch says Google is worse than the NSA
Mr Burns vs. The Chocolate Factory, round three!
Microsoft cries UNINSTALL in the wake of Blue Screens of Death™
Cache crash causes contained choloric calamity
Know what Ferguson city needs right now? It's not Anonymous doxing random people
U-turn on vow to identify killer cop after fingering wrong bloke
Germany 'accidentally' snooped on John Kerry and Hillary Clinton
Dragnet surveillance picks up EVERYTHING, USA, m'kay?
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
Who needs hackers? 'Password1' opens a third of all biz doors
GPU-powered pen test yields more bad news about defences and passwords
prev story

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Solving today's distributed Big Data backup challenges
Enable IT efficiency and allow a firm to access and reuse corporate information for competitive advantage, ultimately changing business outcomes.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.