« Life Threats OK in YouTube Comments | Main | The Dumb-Dumb Phish »

May 05, 2007

Authors of phishing email messages continue to ramp up the threat levels of their missives in an attempt to get even wary recipients to click on their phony links. This one was particularly odd to me:

Dear PayPal Member,

Every business must balance its exposure to risk with its business goals.
At this time, we are not comfortable with the amount of risk your business
exposes itself to.

We would like to begin the process of ending our relationship in a manner
that is least disruptive to your business.

Please log in to your PayPal account and fill out the Limited Account
Access form to let us know what to do with the funds remaining in your
PayPal account.

- Click on the link below:

https://www.paypal.com/cgi-bin/webscr.php?cmd/ssl/Account-Limitation/ID-98273328743/

- Once you log in, you will be provided with steps to restore your account access.

-----------------------------------
Disbursement Options
-----------------------------------

1. Your remaining account balance can be used to provide refunds to your
buyers (if applicable).

If you choose to provide refunds to your buyers, please provide a list of
transaction IDs for the buyers that you would like to refund.

OR

2. Your remaining funds will be held in your PayPal account for 180days
from the date your account was limited. After 180days, you will be notified
via email about how to receive your remaining funds.

We thank you for your prompt attention to this matter and regret any
inconvenience this may cause.

Sincerely,
PayPal Account Review Department

Please do not reply to this email. This mailbox is not monitored a
nd you will not receive a response. For assistance, log in to your PayPal account and click the Help link located in the top right corner of any page. If your inquiry is regarding a claim, log in to your PayPal account and go to the Resolution Center.

----------------------------------------------------------------

PayPal Email ID PP819

The link shown in the message is the fake veneer over the actual URL of the link: a hijacked Japanese web site that then redirects to a hijacked Korean web site.

On the phishing page, the author doesn't continue with the same story of the email message—just the usual "account maintenance" lies and form fields for every piece of personal identity info but your underwear size. This phisher was OK with customizing the email message, but apparently not comfortable with (or technically capable of) doing the same to the server software phishing kit.

A lot of small and home businesses rely on their PayPal account as the primary way of receiving funds from customers. The threat of losing that portal is enough to get a lot of recipients to react to this message out of fear, supplying everything that "PayPal" asks.