Feeds

PayPal update email 'violates own anti-phishing advice'

Oopsie

The Essential Guide to IT Transformation

PayPal UK has sent out an updated user agreement email to its customers that manages to violate its own tips on how to avoid phishing scams. The payments process outfit disputes the accusation.

The message - sent out on Tuesday - bears one of the hallmarks of classic phishing emails by encouraging users to click on a link to visit email0.paypal.com (instead of visiting the main paypal.co.uk site directly) to review updated terms of business. Reg reader Ian, who forwarded us a copy of the offending missive, said the message fell foul of one of seven of PayPal's own tips for avoiding phishing scams, suggesting that visiting sites directly by typing an address into a browser is more reliable than following links in emails.

The page linked to in PayPal's email does not request a user's login credentials, but even so clicking on email links to visit sites rather than typing in a URL or using bookmarks is a bad habit. PayPal should perhaps take its own Can you spot phishing? pop quiz designed to educate users on internet safety.

Helpful hints from PayPal

We asked PayPal to comment on the email, which it confirmed was genuine. Having reviewed the email, PayPal said it doesn't think there is anything wrong with it, and denies accusations that it has violated its own anti-phishing advice.

PayPal does not advise people not to click on links in emails, rather to exercise caution. Users are advised to check the URL of any link to make sure it does not direct them to something unexpected, as you know they can do this by hovering their mouse over the link.

If the link appears suspicious in any way, the advice is to open a new browser window and type the correct address in. The email sent out to customers also includes this, saying users can type paypal.co.uk into a new browser window as an alternative to clicking the link.

Expecting end users to decide whether or not a link in an email is suspicious is, in our opinion, potentially asking for trouble. It would be better for PayPal to stick to its original advice of asking users to type in a URL rather than following links.

Banks and financial services are fond of lecturing customers about the perils of phishing emails - fraudulent messages that try to trick potential victims into handing over their login credentials to fraudulent sites. Sending out emails themselves that invite users to click on an email link somewhat undermines this good work.

PayPal's email security practices have a history of confusing even its own staff, on at least one occasion. Last December we reported how eBay's payment services staffers responded to a complaint about the inclusion of a link in an email from PayPal by treating its own email - which it acknowledged was "suspicious-looking" - as a phishing attack.

"Not even PayPal support can tell the difference between a legitimate PayPal email and a phishing attack," Randy Abrams, director of technical education at anti-virus firm Eset and recipient of the offending email, noted.

PayPal is one of the principal targets of phishing attacks, so it might be a good idea for it to avoid including links to login pages in genuine communiques, a practice many online banks would also do well to apply. ®

Build a business case: developing custom apps

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
iWallet: No BONKING PLEASE, we're Apple
BLE-ding iPhones, not NFC bonkers, will drive trend - marketeers
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
Multipath TCP speeds up the internet so much that security breaks
Black Hat research says proposed protocol will bork network probes, flummox firewalls
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Fiendishly complex password app extension ships for iOS 8
Just slip it in, won't hurt a bit, 1Password makers urge devs
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Maximize storage efficiency across the enterprise
The HP StoreOnce backup solution offers highly flexible, centrally managed, and highly efficient data protection for any enterprise.