PayPal phishing scam uses invoices sent via PayPal
krebsonsecurity.com
krebsonsecurity.com
So a spammer created a project, they put their spam message in the project's name, and started to go through their victim list, inviting each into their project. I suppose that's one way to send an email :-)
It's easy to make money when you can send out thousands of spam emails, each with hundreds of recipients, for under a cent.
What does Google do about them? Making it harder to log in to dormant accounts from new devices and locations. What's the result? Periodic HN complaints on someone unable to access their decade-old dormant account, or an active account with a truly forgotten password, etc.
Anti-abuse is hard. Damned if you do something, damned if you don't.
For dormant account reactivation, they can ask the user for lots of details that are in the account. For example, "please type in email addresses of as many people as possible that you have sent emails to from this account". Which cities have you previously logged into this account from?
All info would be optional, but the more the user provides the quicker they're going to get in.
When the user has provided enough information to be fairly sure that it's a real user attempting to login, then start a 7 day countdown. During the 7 days, contact the users top contacted email addresses and ask them to reply confirming the user is trying to reactivate the account.
Hire attackers to try and break into old accounts, and use their input to find the likelihood of each type of information being correctly given by the real account owner and an attacker.
Also, gmail should never ever by emailing your contacts! It has no idea what your relationship with them is or what information about your actions you want to keep secret from them.
Oh. no. I'd rather they just up an deleted the account, instead.
Google is already painful enough to get into old accounts that you haven't used for a while.
For a dormant account, what's the chances that you're going to remember the email address that someone used years ago? People have address books for that, and the address book is locked on the other side of that password prompt.
> During the 7 days, contact the users top contacted email addresses and ask them to reply confirming the user is trying to reactivate the account.
Yeah, nah. That's awful for several reasons.
It's another phishing-like prompt - "Hey joe bloggs is trying to log into their email. Do you think it's really them? Click here to let them into their account".
If you invert it, then you're at risk of someone with a grudge against you clicking the "No, it's an attacker" link. Even a friend clicking it because they think it's funny.
There's no way I'd want most of the people I email to have any involvement in accessing my account, without me being able to nominate specifically whom the system emailed.
There is no justification in making it difficult to log in to accounts that have never sent spam, that's the user-hostile part of gmail. They have it in their logs which accounts are sending spam.
Sending spam is the last step... The steps beforehand are much more damaging to the user involved. And, sure, you could blame them for reusing their login password, but not being well versed on computer security isn't widespread, nor a reason to punish them.
Locking people out of their account (which sometimes means a large chunk of their real life) with no recourse is very punishing and inexcusable.
The only real solution is not allowing contact form emails to be customized with free text input.
I guess you could have a manual approval loop for "weird" names (more than 30 characters, has a dot in it, etc) or other signs of spam. It would still leave some space for spamming though (I can't imaging a rule that stops "Buy More ETH" but doesn't stop any unusual real name).
I don't know I haven't really probed random contact forms to see if they block this kind of thing.
There's a lot more to do to block this kind of proxy spam entirely for sure I was just talking about the particular problem of using the contact for to send to an mailing list.
I'm sure enough organizations have a mailing list called "customers@company" or "clients@company" to make it worth a shot. Colleges probably have "students@school" or "faculty@school" list.
Might be enough names you can profitably do it by hand.
Edit: this was already pointed out downthread. Missed it before I posted.
In a previous life, I worked at a semi-well-known auto publisher site where scammers literally stood up a copy of almost _the entire site_ (ads, functionality, and all) in order to execute an auto escrow scam. We know of at least one instance where a user in the UK was scammed out of ~$10,000-ish using this method.
Democratization of technology at its best (worst?) I guess...
By chance I looked into the Prime membership page. An obscure page listed the recent Prime charges. Yep, it's the Prime membership charge. The amount looked odd because tax was added to it, where the old charges were like $119 or $139. Amazon employs a dark pattern of not sending to the users any notification on the Prime renewal, no billing statement, no invoice, no email, just a silent charge on the credit card.
I promptly canceled my Prime membership, not for the money but for not rewarding dark pattern behaviors.
Saw the other day a charge get refused on a credit card I cancelled. 3DSecure is mandatory on it, so I kinda panicked thinking I got phished somewhere, but no, it was just Amazon reusing their authorization to charge a year later. I would have actually updated my info if I had a heads up, but now that my membership has been canceled following the charge refusal, it's kind of an occasion to let it go.
Lucky you who was able to get through the dark patterns in the unsubscribe page. I got one extra charge because the first time I tried, I fell for one of their dark patterns and believed it was canceled while it wasn't.
I gave up and blocked it through my bank and the customer service rep said she had to do the same thing. She also said Amazon will blacklist my credit card ... ummm i dont care I dont and will never subscribe again. Just use a friend or family's account and pick it up from them.
Amazon is stupid for pulling these anti-consumer tricks .. all about bottom line now vs. the future. Stupid!!
Before each subscription payment there after, The Bank reminds us with SMS about the payment and we can cancel it through that. For amount > INR 5000 (~ 60$) each subscription payment has to be approved by the consumer.
Amazon still does employ dark patterns, Like having 'Prime membership cancellation' behind several pages and the final confirmation located in a non-prominent location; But Indians can cancel Prime membership without even visiting Amazon's website.
I don’t think Amazon would be viable today if they dropped their dark patterns and held vendors accountable.
I am at a point where I’d rather go shop at a physical Walmart or Target than buy something from Amazon.com. Driving to a physical store causes me less frustration in 2022.
e.g. this (and many others) AMA on Reddit [0]
[0]: https://www.reddit.com/r/IAmA/comments/9dw73/i_am_a_spammer_...
Windows used to have a "secure attention sequence", CNTL-ALT-DEL, which you had to push when you really wanted to talk to the security functions of the operating system. That stopped being mandatory in Windows 10, due to "customer confusion", although some enterprise configurations turn it back on.
The concept comes from some DoD security projects from around 1980. Microsoft picked it up when Windows NT was being developed. Some DoD systems have also used a brightly colored screen border to indicate the degree of classification of the content. But that's too intrusive for consumer use.
There are so many layers now that it's hard to provide a secure path that can't be compromised.
On the other hand all current iOS devices have some hardware level SAK-like gesture that directly confirms the user intent to the secure enclave. The overall UX design is such that it is not especially noticeable unless you know that there is such a thing.
EDIT: BofA called it SiteKeys. And it looks like they were "useless" according to this article [0]. Someone even wrote a paper on it [1]. Seems several banks actually implemented this concept and then phased it out.
[0] https://www.marketwatch.com/story/banks-find-online-security...
[1] https://users.ece.cmu.edu/~lbauer/papers/2014/w2sp2014-secur...
Okta still does that same trick on their login screens. Since I have several Okta logins, there's no way I would be able to remember which of the 9(?) icons matched with which domain, so I hear you about them being useless. I would be able to spot one of the "wrong" ones, as there are a class of those icons that I would never choose so ... security? :-/
These days I think the best way to be sure you are on the correct site is to have the browser store at least the username/email used for a login and never login if the browser won't fill in that info (often saving the password is a good idea too depending on your situation). I've thought it would be helpful if browsers had a "site bookmark" feature that would show you are on a site you had previously labeled while visiting any page on the site, however I'm not aware of any browser actually doing that.
At the OS level a phrase could potentially work since there isn't the same MITM risk, although graphics drivers are complex and there could easily be a bunch of ways the phrase could leak. I wish there was a second small and simple display with at least a couple of buttons for security purposes. Maybe rough for phones but larger devices could do that. Or even two of them, one for communication with the OS and one for accessing credentials. The second could be removable for use with multiple devices. Of course, this comes with accessibility challenges that need to be considered.
So just show one of them and the word for the object and you'll probably be right quite often if the user even notices.
In SL, you can create objects and have them speak (via the onscreen text chat window). You were allowed to give them any name, so I would name them after another player, letting me "throw my voice" and impersonate them.
The devs apparently realized this problem early on, and their fix was: objects speak with green text, human players speak with white text. But this isn't disclosed anywhere, and there weren't many speaking objects at the time.
So my workaround was to name an object after another player, wait for them to go afk, and then have the object say, "Hey guys, guys, check this out! I can make my text green! Woo hoo!" And then say all the malicious stuff I wanted them to say.
I don't think these companies understand the DNS system and purpose.
Unfortunately after eBay bought PayPal, they put MBAs in charge, and the marketing team won every argument about the "necessity" of alternate domains to track marketing initiatives.
They never really took into account the lost reputation of users getting constantly phished.
Edit: To clarify, there were a lot of good reasons not to allow them to link to a subdomain, especially they were running marketing software made by other companies, because there is a lot of nasty security issues around cookies with subdomains.
But there was no reason for them not to route their outbound email through a single domain, because the weren't supposed to run 3rd party mailers without deep audits.
And a subdomain requires negotiating with someone in the bowels of IT, whereas anyone can register PayPal-communications.com
And as soon as the external agencies are involved, they want as much control as possible. I don’t blame them: setting up DNS entries for some stupid marketing site rarely rises to anyones priorities. So they route around internal controls. Everyone is happier, and everything gets slightly worse.
Edit: Is there a website to name-and-shame big companies who screw up SPF/DKIM/DMARC?
To make matters worse, the invoice sits there in your PayPal account, and you're just a mistaken click or so away from authorizing the charge. Under my "activity" section, it sits right at the very top, forever, under the "Pending" headline (since early July). For whatever reason I can't get rid of it (PayPal killed the actual invoice after a week, they must have noticed the fraudulent activity from that account; but the invoice card summary remains in my activity under pending, perpetually).
Here is what the core of the emailed text looks like:
"You Purchased BITCOIN (0. 054631) for $ 847. 12. Reference Number-N34421979 If you have any concern regarding your order kindly contact us because we are getting lot of complaints regarding fraudulent orders. HELP-DESK (806)440-0799."
It arrives from service@paypal.com with the email subject saying the invoice is from PayPal (rather than being from xyz merchant or similar; which only adds to the concern that a fraud has already occurred within my PayPal account). The text in the email otherwise looks legitimate as I assume it did arrive from PayPal's service. It would be easy for a normal user to fall for the scam.
In their haphazard greed, PayPal slipped up and made their invoicing system too loose, too unconstrained in how it functions.
Also, phone numbers. My dad (in his 50s and pretty tech savvy) recently received one of these and then called PayPal. Their CS people started asking for remote access to his computer (so they could see how he'd been hacked), which thankfully set off alarm bells big time and he hung up.
He swore up and down that he'd looked up PayPal's number online, that he'd never call a number that arrived in an email, but when we looked at his phone history he'd definitely called the number the scammers had sent.
This was pretty sobering for me. He was 100% sure he wouldn't call a number that arrived in an email. He knew it was the wrong thing to do. But in the panic surrounding the alleged fraudulent charge, he'd forgotten and just called the first number he saw. I like to think I wouldn't do the same, but when it comes right down to it I can't be sure.
He may have. Scammers seed the fake numbers on various web forums, Facebook business pages, etc.; I see folks try it on StackOverflow fairly regularly. Sometimes there are entire convincing fake websites that come up in Google.
In truth, you got the best possible experience and it's good that you reported it. Ultimately, what would happen internally is that we'd detect this malicious use and cancel the invoices so it's not possible for the scammer to continue to collect on them--but we couldn't "claw back" the emails that had already gone out. The email looked legit because it was an email from PayPal about a real invoice.
I don't know if they should be more proactive in their communication with folks in this situation and it's been over a year since I left; but, this is not a new issue at all and it's something we would contend with from time to time while I was there.
I wish I kept the number to call them back and piss them off. Scammers/phishers are soulless entities of this earth.
Like, I get it, somebody probably has my email address, but I never really got these before.
And I doubt it’s somebody’s typo.
Would think a company as big as PayPal would be able to cut off the source once the source requests more than 3 different logins by SMS.
Just noticed my legitimate requests are in the form of “PayPal: xxxxxx is your security code. It expires in 10 minutes. Don't share this code with anyone.”
But the last one I didn’t request didn’t have an expiration mentioned:
“PayPal: xxxxxx is your security code. Don't share your code.”
“Your login code is 8kqhc1abw0v6n11kmdi0py5lwy. Do not share this with anyone”
One way to protect yourself is use a different email address, and only for services. Many email sites allow custom addresses, so you can create specific emails addresses for each service.
And if your cellphone number is also leaked, get a sms service with a different phone number.
https://haveibeenpwned.com and you can do a check on yourself.
I find it sad Google sells titan keys but ignores them on login.
PayPal has a problem on its hands if it’s unable to see if they’re legit.
My company is getting dozen of mail with “overdue” invoices from some random corporations for services like elevator inspection, heating checks, etc. Of course, they also have some strange phone number to call (which has just automated message). These people just hope we will pay and move on.
We wanted to report them but it is a lot of work.
The worst part about these scams is that the invoice email is legitimate, as in, it's actually coming from PayPal and it's not a "fake" email.
It took me a while to figure out what's going on, these were the steps that I took:
1. Examined the headers which looked legit, because well,
it's really from paypal.
2. Googled the phone number, and could not find any
mentioning of it on Paypal (though I must say it did
seem like a similar number to at least one of Paypal's numbers)
3. Checked Truecaller and found no record of this number (I later updated
this number description to alert other people from phishing attempts.
4. Logged in to my account, just to make sure (without clicking the link),
and found no evidence of any funny activity.
5. Googled the phishing text and could not find relevant results,
yet Paypal itself did have a page with very similar text (well thought out phishing attempt)
6. I stripped the link from all query strings, opened it in incognito,
and voila, I saw that it's an invoice page that anyone can access and pay.
7. I tried to click the "Feedback" button on that page,
which I expected to show me an option to report a phishing attempt but instead
it just did nothing, absolutely nothing, on both FF and Chrome
(not even a console error that I can remember seeing).
1. Paypal are using _exactly_ the same email address for invoice notifications as other formal emails that I get from Paypal.
2. Paypal are not framing the invoice in any way to indicate that it's originated from the invoice sender,
thus allowing fraudsters to convey the same official tone as the rest of their email.
3. Phishing@paypal.com is how you report phishing attempts to Paypal though they do I'm not sure what effect reports have.Is it just that the invoice is a real invoice but isn't debited against the target's paypal account?
Or is the invoice fake somehow?
There was a posting on HN around that time about a hacker accessing passwords stored in the browser. I didn't save it, but cleaned out my stored passwords just the same.
Oh well. Guess they don't care.
This. If your site is being used for phishing attacks, many users may just stop using your service, because it's not worth the trouble.
I used to have an automated list of popular phishing sites.[1] It's still running, but since it's driven by PhishTank, which isn't used much any more, it's not that interesting.
At the same time though I keep coming across companies that insist on using designs that trigger my "this is phishing" alarm bells because for whatever reason they insist on using links to the company that they contracted billing to instead of, you know, the company I did business with.
It seems especially prevalent among, of all groups that should know better, medical companies[1]. So say I had a visit with The Awesome Doctor Company, I'll get emails that for "privacy" reasons saying "You have a balance due at wedopayments.com", or "billing-awesomedoctorco.com", etc the latter being one of the most common things phishing emails do (I think I've actually got billing-paypal.com or similar at least once).
[edit: [1] Ah ha, found the actual site, so remember I got an email saying "you have a balance due", that included no other details to peryourhealth.com. Which was for the company "East Bay Anesthesiology" (which I also didn't know of/about, but Sutter Health just silently outsourced that part of operation to them, didn't tell me, and then had them bill me directly and separately??!??!!? God I hate the US healthcare system)]
I tried to dispute or flag it, but there's no such option in their interface — and there was no memo to go to a website or call a number. Very weird. I thought the scam was "let's hope someone doesn't look at the details and pays this invoice without thinking"
Worst part is that the only option via email is to "Pay". I have to log into PayPal then go through multiple clicks to reject the money request.
Why can't I report & deny in one click?
Because then PayPal would have a massive number of reports to follow up on.
I also reported it to PayPal. Apparently they’re to big to care.
More awareness of the various possibilities of this need to occur.
I recall when this was happening to me in 2017 many people on forums like this wouldn't believe me, choosing to blame the victim instead of the person that made a choice in trying to create a victim. I'm all for some level of agency amongst people to not be a victim, but in the order of diagnosis of the problem this email header issue should be put more highly up on the list.
I called the toll free number just to see what would happen. My call quickly got picked up by an actual person, answering in a way that is not legitimate, plus the "call center" background noise you hear that's very suspicious.
Otherwise, it is indeed quite a legitimate looking scam
I've screamed each time I saw one of these. Not that it likely did any good.
The sample I reviewed had been set to an account belonging to (or compromised by) the scammer, modified slightly, and BCC'd to the victim. Specifically, a Reply-To header was added - PayPal does not assert non-existence of a reply-to header in their DKIM signature, and the entire point of BCC is that it doesn't have a header.
Thus, these emails can be relayed to any target, and the scammer can choose any reply-to address they like, and the DKIM signature will still be valid.
If anyone has samples and can send me them with full headers, I would be very interested to examine more. I have a public email address in my HN profile.
The vector here is:
1. Create a PayPal account. 2. Create an invoice through PayPal's invoice tool and send to nabakin@example.com. 3. PayPal sends an email to notify the recipient of the outstanding invoice.
When PayPal detects fraudulent invoices are generated, they cancel those invoices so consumers no longer see them and can no longer pay on them; however, it's too late to stop the emails.