Feeds

PayPal update email 'violates own anti-phishing advice'

Oopsie

Protecting against web application threats using SSL

PayPal UK has sent out an updated user agreement email to its customers that manages to violate its own tips on how to avoid phishing scams. The payments process outfit disputes the accusation.

The message - sent out on Tuesday - bears one of the hallmarks of classic phishing emails by encouraging users to click on a link to visit email0.paypal.com (instead of visiting the main paypal.co.uk site directly) to review updated terms of business. Reg reader Ian, who forwarded us a copy of the offending missive, said the message fell foul of one of seven of PayPal's own tips for avoiding phishing scams, suggesting that visiting sites directly by typing an address into a browser is more reliable than following links in emails.

The page linked to in PayPal's email does not request a user's login credentials, but even so clicking on email links to visit sites rather than typing in a URL or using bookmarks is a bad habit. PayPal should perhaps take its own Can you spot phishing? pop quiz designed to educate users on internet safety.

Helpful hints from PayPal

We asked PayPal to comment on the email, which it confirmed was genuine. Having reviewed the email, PayPal said it doesn't think there is anything wrong with it, and denies accusations that it has violated its own anti-phishing advice.

PayPal does not advise people not to click on links in emails, rather to exercise caution. Users are advised to check the URL of any link to make sure it does not direct them to something unexpected, as you know they can do this by hovering their mouse over the link.

If the link appears suspicious in any way, the advice is to open a new browser window and type the correct address in. The email sent out to customers also includes this, saying users can type paypal.co.uk into a new browser window as an alternative to clicking the link.

Expecting end users to decide whether or not a link in an email is suspicious is, in our opinion, potentially asking for trouble. It would be better for PayPal to stick to its original advice of asking users to type in a URL rather than following links.

Banks and financial services are fond of lecturing customers about the perils of phishing emails - fraudulent messages that try to trick potential victims into handing over their login credentials to fraudulent sites. Sending out emails themselves that invite users to click on an email link somewhat undermines this good work.

PayPal's email security practices have a history of confusing even its own staff, on at least one occasion. Last December we reported how eBay's payment services staffers responded to a complaint about the inclusion of a link in an email from PayPal by treating its own email - which it acknowledged was "suspicious-looking" - as a phishing attack.

"Not even PayPal support can tell the difference between a legitimate PayPal email and a phishing attack," Randy Abrams, director of technical education at anti-virus firm Eset and recipient of the offending email, noted.

PayPal is one of the principal targets of phishing attacks, so it might be a good idea for it to avoid including links to login pages in genuine communiques, a practice many online banks would also do well to apply. ®

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
China hacked US Army transport orgs TWENTY TIMES in ONE YEAR
FBI et al knew of nine hacks - but didn't tell TRANSCOM
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.