PayPal is being targeted for phishing scams. The company has been used for such scams in the past, but this time it appears the crooks are being a bit more creative rather than the old fashioned link in an email message. They are using texts and SMS to send a note stating the user’s PayPal account has been locked.
The text looks professional and simply states “PayPal – Your account has been locked Please click in the link below to restore your access” and is followed by a link starting with http://. Another version is “Important Security Alert about your PayPal account. Please click the link bellow to read it” followed by another link.
The giveaways in most phishing email are typos and incorrect grammar and punctuation. While it is sometimes more difficult in text messages to know if the missing periods or capitalization is from a scammer, is laziness, or just fingers too big for the tiny keypad, it is still important to take note, especially when the message comes from a business.
Another identifier in this text is the lack of an “s” after the “http” in the link. Although not always, messages about account information and restoring access will typically (and should be) be secured. Therefore the beginning of the legitimate link will be ”https://.” However, most financial organizations will not send links for resetting account details unless you specifically request to reset your passwords or user names. In that case, the messages will come shortly after your request and often expire shortly after that if they have not been used.
Users who click on the fake links in these messages will be directed to a fake PayPal website. It has the original graphics and formatting, but really steals login credentials for PayPal accounts. This allows the criminals to make transactions using someone else’s money.
If you receive a message about locked accounts or restoring access, changing passwords or credentials or anything account related, go directly to the website of the business and login that way. It’s best to have a link that you know is safe bookmarked in your browser and to use that.
The PayPal team will not send messages to users via a generic method. In addition, personal notes will be preceded by the account holder’s name.
For banks and credit unions
Share this article with your members
Copy a ready-made summary and link for your newsletter, website or social posts.
