[DeanFL]

For those who are PayPal members - warning. Phishing Scam

I have received emails from "PayPal" weekly for over a month now. As I do with all unknown senders (or questionable) I delete and/or label Scam.

Once again this morning received from 'PayPal Service <service.intl@paqyapal.com>' with the message>


------------------------------------
Your PayPal account has been limited because we've noticed significant changes in your account activity.
As your payment processor, we need to understand the situation better.

What's going on?

This account limitation will affect your ability to:
Send money
Withdraw money
Receive money
Also , you won't able to:
Remove any bank accounts
Remove any credit cards
Close your account

How to remove my restriction.

You can resolve your restriction by following these simple steps:
Log in to your PayPaI account.
Provide the information associated with your account.
The sooner your provide the information we need, the sooner we can resolve the situation.
------------------------------

After Scam/Delete again today - I did a bit of research>


There’s a “Your account has been limited” email in circulation, targeting users of PayPal. The mail, which (bizarrely) claims to come from servicesATapple.com, claims that the account needs to be unlocked by confirming the potential victim’s identity.
The link leads to a .ma URL, which is the country code for Morocco:

confirm-identity(dot)me(dot)ma

The page is currently offline, but there’s a collection of related websites with similar URLs as per this VirusTotal page.

Some of these have been taken down, a few are still live so it’s probable there are multiple email campaigns leading to each of the fake sites:

confirmation-identity(dot)ab(dot)ma/
confirm-identity(dot)about(dot)ma/
verification-identity(dot)me(dot)ma/
resolution-center(dot)me(dot)ma/
confirm-identity(dot)about(dot)ma/
confirm-identity(dot)ab(dot)ma/
verification-identity(dot)mx(dot)ma/

A few examples of what’s on offer: a page asking for card details, a redirected URL asking for PayPal username / password and a site removed message.

Clearly, somebody really wants to get their hands on PayPal logins and payment information. In all cases, delete the mail and don’t click on the URLs which aren’t official PayPal domains or secured with https (occasionally phish pages use https, but they’re pretty rare) . If in doubt, look for the green box on the left hand side of the URL bar. Clicking it will tell you that you are indeed on the right site and can login safely.

[The Shadow]

Thanks, good to know.

[villagetinker]

Great research and background, thanks.

[dmaycott]

Got it as well. Just delete it.

[Mleeja]

Thanks for the info. I use Pal Pal all the time!