PayPal sends links to phishing sites

Fake hyperlinks to ‘secure. uninitialized. real.error.com’ were sent by PayPal online payment service to its customers to confirm recent payments in the course of a significant period of time, reports the Register. The link was advertised as the official address to log in to the service. The mishmash was a result of an internal PayPal error that was fixed on Tuesday as reported by Michael Oldenburg, a spokesman for PayPal parent company eBay. When asked in an email about how long the error existed, Oldenburg gave no response. Meantime the quick Yahoo search revealed the page that showed a PayPal customer receiving the link more than two months ago.

During the last several months PayPal customers faced numerous sophisticated attacks with bills being sent to them for Skype and another services. PayPal is frequently targeted by phishers who send out a multitude of fraudulent emails that try to lure users to phony PayPal websites that trick them into revealing their personal information. The link provided this time in the fake email sent the users to a non-existent page on the error.com domain.

This link was uncovered by the Register in the course of investigation of the fraudulent Skype charges made against the accounts of PayPal customers and credit card holders. As per the statements of Oldenburg, members of eBay's Trust and Safety team are aggressively investigating the fraud. For now, he repeatedly recommends the users to never click on links in emails, even when those emails are sent by a bank, merchant or PayPal. Instead, they should open a new browser window and manually type in the address. Interestingly, but official PayPal emails still have links to the company's log-in page provided in the emails sent to their customers.