Feeds

PayPal update email 'violates own anti-phishing advice'

Oopsie

SANS - Survey on application security programs

PayPal UK has sent out an updated user agreement email to its customers that manages to violate its own tips on how to avoid phishing scams. The payments process outfit disputes the accusation.

The message - sent out on Tuesday - bears one of the hallmarks of classic phishing emails by encouraging users to click on a link to visit email0.paypal.com (instead of visiting the main paypal.co.uk site directly) to review updated terms of business. Reg reader Ian, who forwarded us a copy of the offending missive, said the message fell foul of one of seven of PayPal's own tips for avoiding phishing scams, suggesting that visiting sites directly by typing an address into a browser is more reliable than following links in emails.

The page linked to in PayPal's email does not request a user's login credentials, but even so clicking on email links to visit sites rather than typing in a URL or using bookmarks is a bad habit. PayPal should perhaps take its own Can you spot phishing? pop quiz designed to educate users on internet safety.

Helpful hints from PayPal

We asked PayPal to comment on the email, which it confirmed was genuine. Having reviewed the email, PayPal said it doesn't think there is anything wrong with it, and denies accusations that it has violated its own anti-phishing advice.

PayPal does not advise people not to click on links in emails, rather to exercise caution. Users are advised to check the URL of any link to make sure it does not direct them to something unexpected, as you know they can do this by hovering their mouse over the link.

If the link appears suspicious in any way, the advice is to open a new browser window and type the correct address in. The email sent out to customers also includes this, saying users can type paypal.co.uk into a new browser window as an alternative to clicking the link.

Expecting end users to decide whether or not a link in an email is suspicious is, in our opinion, potentially asking for trouble. It would be better for PayPal to stick to its original advice of asking users to type in a URL rather than following links.

Banks and financial services are fond of lecturing customers about the perils of phishing emails - fraudulent messages that try to trick potential victims into handing over their login credentials to fraudulent sites. Sending out emails themselves that invite users to click on an email link somewhat undermines this good work.

PayPal's email security practices have a history of confusing even its own staff, on at least one occasion. Last December we reported how eBay's payment services staffers responded to a complaint about the inclusion of a link in an email from PayPal by treating its own email - which it acknowledged was "suspicious-looking" - as a phishing attack.

"Not even PayPal support can tell the difference between a legitimate PayPal email and a phishing attack," Randy Abrams, director of technical education at anti-virus firm Eset and recipient of the offending email, noted.

PayPal is one of the principal targets of phishing attacks, so it might be a good idea for it to avoid including links to login pages in genuine communiques, a practice many online banks would also do well to apply. ®

Combat fraud and increase customer satisfaction

More from The Register

next story
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
prev story

Whitepapers

Designing a defence for mobile apps
In this whitepaper learn the various considerations for defending mobile applications; from the mobile application architecture itself to the myriad testing technologies needed to properly assess mobile applications risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.