PayPal Phishing: “Your Account is Limited”



PayPal Phishing CampaignA PayPal smishing campaign is trying to trick users into handing over their credentials and personal information, BleepingComputer reports. The text messages state, “PayPal: We've permanently limited your account, please click link below to verify.” (Note, by the way, the poor command of English idiom. The message includes a comma splice and there’s some uncertainty about the use of articles.)

The link in the message leads to a phishing page that appears identical to PayPal’s login portal (although the URL is clearly different). If a user enters their credentials and clicks “Log In,” they’ll be taken to a second phishing page that asks them to enter their name, address, and bank account details. All of this information will be sent to the attacker.

BleepingComputer says users should be wary of any unsolicited text messages, especially if they contain a link. PayPal does limit accounts when it detects suspicious activity, but you can check the status of your account by going directly to paypal.com instead of clicking on a link in a text message.

“Smishing scams are becoming increasingly popular, so it is always important to treat any text messages containing links as suspicious,” BleepingComputer writes. “As with all phishing emails, never click on suspicious links, but instead go to the main site's domain to confirm if there is an issue with your account.

The publication also offers advice for people who may have fallen victim to this attack, urging them to be on the lookout for future social engineering attacks that incorporate their personal information.

“If you received this text and mistakenly logged into your PayPal account or provided other information, you should immediately go to Paypal.com and change your password,” BleepingComputer says. “If you use that same password at other sites, change them there as well. Finally, you should look out for other targeted phishing campaigns using the submitted data. BleepingComputer also suggests that you monitor your credit report to make sure fraudulent accounts are not created under your name.”

New-school security awareness training can help your employees defend themselves against these attacks by teaching them to recognize different types of phishing attacks.

Bleeping Computer has the story


Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

https://www.knowbe4.com/phishing-security-test-offer

Topics: Phishing



Subscribe to Our Blog


Comprehensive Anti-Phishing Guide




Get the latest about social engineering

Subscribe to CyberheistNews