Fake hyperlinks to ‘secure. uninitialized.
real.error.com’ were sent by
PayPal online payment service to its customers to confirm recent
payments in the course of a significant period of
time, reports
the Register. The link was advertised as the official address to
log in to the
service. The mishmash was a result of an internal PayPal error that was fixed on Tuesday as reported by
Michael Oldenburg, a spokesman for PayPal parent
company eBay. When asked in an
email about how long the error existed, Oldenburg gave no response. Meantime the quick
Yahoo search revealed the page that showed a PayPal
customer receiving the link more than two months ago.
During the last several months PayPal customers faced numerous sophisticated attacks with bills being sent to them for Skype and another services. PayPal is frequently targeted by phishers who send out a multitude of fraudulent emails that try to lure users to phony PayPal websites that trick them into revealing their personal information. The link provided this time in the fake email sent the users to a non-existent page on the error.com domain.
This link was uncovered by the Register in the course of investigation of the fraudulent Skype charges made against the accounts of PayPal customers and credit card holders. As per the statements of Oldenburg, members of eBay's Trust and Safety team are aggressively investigating the fraud. For now, he repeatedly recommends the users to never click on links in emails, even when those emails are sent by a bank, merchant or PayPal. Instead, they should open a new browser window and manually type in the address. Interestingly, but official PayPal emails still have links to the company's log-in page provided in the emails sent to their customers.
