The Continuing Adventures of Jud

Got a real beauty in my e-mail today…

“Dear PayPal Member,

This email confirms that you have paid EBATES (sales) $249 USD using PayPal.
This credit card transaction will appear on your bill as "PAYPAL EBATES.COM*".

--------------------------------------------------------------------------------

PayPal Shopping Cart Contents
Item Name: Apple iPod Video (Black) 30GB MP3 Player
Quantity: 1
Total: $229 USD
Cart Subtotal: $229 USD
Shipping Charge: $20.00 USD
Cart Total: $249 USD

--------------------------------------------------------------------------------

Shipping Information
Shipping Info: J***** B*****
#### XXXXX st benton harbor, MI 49022 United States
Address Status: Unconfirmed

--------------------------------------------------------------------------------

If you haven't authorized this charge, click the link below to cancel the payment and get a full refund.
Dispute Transaction (click-able link)
Thank you for using PayPal!
The PayPal Team
Please do not reply to this e-mail. Mail sent to this address cannot be answered. For assistance, log in to your PayPal account and choose the "Help" link in the footer of any page.
PayPal Email ID PP120”

-----------------------------------------------------------------------------

Knowing I had made no such payment or purchase, I first checked on the link provided for dispute: [http://www.google.com/url?sa=X&oi=dict&q=http://mail.cbcs.co.za/.s/united.states.validation/.secure/cgi-bin/index.htm]
and then forwarded this with full headers to Spoof@ paypal.com. A few moments later, I received their standard auto-reply:

-----------------------------------------------------------------------------

“Dear Jud,

Thank you for contacting PayPal about a fraudulent (spoof) email or Web site. We appreciate you bringing this suspicious email to our attention.

We can confirm that the email you received was not sent by PayPal. Any website which may be linked to this email is not authorized or used by PayPal.

Our fraud prevention team is working to disable any website linked to this email. In the meantime, please do not enter any information into this website. If you have already done so, you should immediately log into your PayPal account and change your password, as well as your security questions and answers. We also recommend that you contact your bank and credit card company immediately.

Please follow the instructions below to report an unauthorized transaction associated with your PayPal account:

If you are able to log into your PayPal account:

1. Log in to your account at https://www.paypal.com

2. Select the "Resolution Center" subtab.

3. Click "Open a dispute."

4. Select "Unauthorized transaction," then click "Continue."

5. Enter or select the transaction ID for the transaction you would like to dispute, then click

"Continue."

6. Complete the report for Unauthorized Use on a PayPal Account, then click "Continue."

7. Confirm that the claim is correct, then click "Submit."

If you cannot log in to your account, follow the instructions below to report an unauthorized transaction associated with your PayPal account:

1. Go to https://www.paypal.com/

2. Click on the "Security Center" link located at the bottom of any page.

3. Under the "Report a Problem" column, click on "Unauthorized Transaction."

4. Click "Continue" under "Unable to log in?"

5. Confirm that the transaction in question is unauthorized then click "Continue."

6. Complete the report for Unauthorized Use on a PayPal Account, then click "Preview."

7. Confirm that the claim is correct, then click "Submit."

8. Confirm your account ownership by entering the financial information requested, then click "Continue."

Lastly, we recommend taking a few steps to protect yourself from identity theft:

1. Download the SafetyBar, a toolbar for Outlook and Outlook Express, which identifies known spoof emails.

2. Get eBay Toolbar with Account Guard which warns you when you're on a potentially fraudulent (spoof) Web site.

3. Sign up for Equifax Credit Alerts for PayPal Users, a program that provides an early warning detection system in the event of identity theft. Find out more by visiting the PayPal Identity Protection Center at www.paypal.com/idprotection.

4. Frequently monitor your PayPal account for suspicious activity.

For additional tips please visit the PayPal Security Center at
https://www.paypal.com/security.

Thank you again for sending us your report. We appreciate your efforts
to keep PayPal safe.

Sincerely,

PayPal
PayPal Account Review Department”

-----------------------------------------------------------------------------

Usually, I just carry on from there, but this one had upped the ante a bit. I could see someone easily falling into this trap, trusting in the payment dispute process to resolve this matter and trustingly clicking on that link, which I am sure looks very good and asks for all sorts of personal information and passwords, probably bank account numbers, for many, if not most, of Paypal’s customers have a bank account linked to their Paypal account in order to be verified by paypal- too bad they are not as judicious with the scammers. So, seeing the increased risk in this one, and frankly just a bit sick of the same old form letter, I wrote back to spoof@paypal.com:

--------------------------------------------------------------------------------

“Hi Paypal,

"Our fraud prevention team is working to disable any website linked to this email..."

You know, I have pretty much got that message from you memorized. This is getting ridiculous. And serious now. This account is tied to my bank account and you need to stop worrying about your growth rate and simply block these obvious internet servers that are enabling these scammers. I always attach full headers and it is obvious to me, a total novice, at a glance that they are phony. You continued form letter response is just not cutting it anymore.

Jud”

-----------------------------------------------------------------------------

And then I thought about it a bit further.

As I said, the headers on these things as well as the links inside them are easily spotted (at this point) by the simplest action and that, along with the fact, generally known that most of the scam e-mails originate from one particular country makes the solution glaringly obvious- just disconnect net access from any server in that country until said country cleans it up.

Oh, you say, but they will simply rout through another country!

Well, then cut those servers off.

And so on and maybe we end up cutting the sacred “growth of the internet” for a while, but since next to gaming and porn the number one industry on the net seems to be fraud, maybe not such a bad idea: trade in a bit of that “virtual” growth for a bit of responsibility.

I am not a geek, don’t even play one on TV, and didn’t stay at that special hotel last night, but it seems to me, when I get dozens of spams and scams a day, while my own e-mails are so carefully limited if I CC too many people, that this is simply not being taken seriously by the businesses who seem more concerned with their hit count and stock price. I suspect that truly handling this increasing threat would slow their service a bit, or maybe lower their statistics or some other factor they consider more important, but I simply cannot believe that they are technologically unable to effectively filter this stuff out or better yet, simply cut off the clearly offending enablers, those ISP’s that provide service to the criminals.

I have one on-line e-mail account that is known to exist to only three people, and used by only one, a rather unique address quite differentiated from any of my other addresses, never used to register at any other site or service or subscription, and provided by one of the more reputable services, and yet since the beginning of that account, I have received roughly ten spams to every legitimate e-mail there. If the company had sold a list of e-mail addresses it would hardly be worse.

I am probably exposing my own naivety on tech matters here, and I plead guilty, but maybe I am also exposing that it is merely lip service that is being given to combat a major problem on the internet.

Just cut them off.