> The form itself even has Google's warning not to provide credit card numbers down the bottom.

I received a PayPal phishing email once which included PayPal's actual security footer at the bottom. It helpfully pointed out that communications from PayPal will always address you by name, never as "Dear customer".

I was amused by this, since the phishing email started off with "Dear customer".

There must be some population of people out there who are looking for the footer, but not bothering to think about what it means. (Or possibly a population of scammers who copy the official formatting without checking whether it's something they really want.)

Don't get me started on Paypal. They send emails from a domain that isn't paypal.com with login links in the email that point to a domain that isn't paypal.com

I genuinely can't distinguish official Paypal emails from phishing emails - and that's because the Paypal emails look like bad phishing emails rather than because phishing emails are so sophisticated.

EDIT: Good write up here: https://cantoriscomputing.wordpress.com/2017/03/04/paypals-e...

I've reported such emails to [email protected] and never got a reply. Maddening. I never open mails from PayPal now - better safe than sorry.

Edit: https://news.ycombinator.com/item?id=15296425

The last time I attempted to sell something on eBay, twice in a row a scammer -- presumably in the Ukraine -- won the auction and then proceeded to send me a spoofed Paypal payment confirmation (from: [email protected]) written in Cyrillic. The mailing address was a drop ship company in New Jersey. Then they were aggressive about sending me messages like, "I paid, have you sent it yet??"

I ignored them and sent the spoofed emails to the spoof addresses at both eBay and Paypal, which seemed to be entirely ignored. After the required amount of time passed I reported the auction winners as non-paying, and I finally got my seller's fees "refunded" to my eBay account.

Then, a couple of weeks ago, I attempted to get eBay to actually transfer my fee credit to my bank account. eBay responded with, "We would really love to help you out with this. but due to COVID-19 we can't."

Somehow one of the fraudulent buyers has had an eBay account since 2012, and it's still active and has a 92% positive feedback rating. Their current auctions include a used gynecological examination chair. It's as if they're flaunting the fact that they can get away with whatever they're doing without being held accountable by either eBay or Paypal.

As a bank we do the same thing. Driven by the fact we don’t want our login emails to come from a domain that also sends “normal” emails in case spam filters start dropping emails from our primary domain.

This isn’t a hypothetical concern either, having spam filter go crazy happens more often than you expect, and some of them drop emails completely rather than putting them into a spam folder (looking at you Microsoft).

Unlike PayPal we make it easy to verify our domains. https://monzomail.com

Oh my god the closure on that link. You couldn't write satire this good. Bureaucracy distilled.

There's a theory about phishing emails that they deliberately make them slightly more obvious in order to weed out people like yourself who are unlikely to fall for them, to increase the average ROI of time spent on dealing with responses.

BTW legit Paypal footer does NOT include such warning at all

From a recent email

> How do I know this is not a Spoof email? PayPal is committed to preventing fraudulent emails. Emails from PayPal will always contain your full name. Spoof or "phishing" emails tend to have generic greetings such as "Dear PayPal member". To learn more, go to the PayPal website and click Security.

-My bank sent an (authentic, it turned out) E-mail including the ‘We’ll always use your first name in our correspondence with you to prove we’re who we claim to be.’

The E-mail started «Dear $FORNAVN...» (Where ‘fornavn’ is Norwegian for ‘first name’)

When I called them up to ask, the helpdesk rep just sighed and suggested that the mail merge script had probably crapped out. Again.

I'm always skeptical of when companies say they will "never" do something. How in the world do all your employees know to never do that thing? Are you constantly reminding people every day in your office of the list of things to never do? Even if you're one person that's an insanely strong promise to make to anyone about your future actions. How does a company have such confidence in the future? The only way I can imagine this working is if they make it impossible for themselves to do that thing, which itself is practically impossible in these cases.

I would assume that only certain employees are authorized to email customers at all, and they have been trained to follow the policies.

I mean, in theory, yes, but I mean, I'm sure you've seen your share of mishaps, right? Like when companies send "Dear $CUSTOMER..."? When something that blatantly obvious can get through, what confidence do you have that training is enough to prevent more subtle things like this for all eternity?

I can't recall an instance of Dear $CUSTOMER sent to me personally. If it has happened it must have been very long ago.

Amusingly enough, I got a Dear %{CUSTFIRSTNAME} from my auto loan provider less than an hour ago.

This isn't even restricted to email.

I have a paper letter here from my dentist, the purpose of which is to explain that they've cancelled all routine appointments, because duh, of course they have.

The letter addresses me as "Mr" in some places and as "MrNicholas" (no space) in other places. But to be fair it also claims the problem is COVID-9 (not COVID-19) so I'm guessing that correctness was not the number one focus of the person typing it.

We had some employees working from a coworking space last year, and we would receive invoices from The coworking biz addressed to "MR Company Name". They would frequently omit our VAT number as well. Of course, we could not pay those invoices, and whenever we got in contact with their support The response would be so delayed that we already had received multiple warnings and threats from their automatic invoicing system. They did eventually get their shit together and voided all The junk invoices they had sent us, but it took three months or so... And this was a huge player in coworking, not a small indie bussiness.

Mail merge is mail merge, be it, to an email, letter or text. Dental practices aren't usually big enough to have a person who devotes such a large percentage of their time to composing mail merge templates as to become slick at the task. Rather than being sarcastic you would be better being grateful that they were courteous enough to go to the bother and expense of writing to you at a time when their business was experiencing complete shutdown and they themselves were facing total loss of income. They probably had more on their mind than pleasing pedants who'd focus on trivia at a time like this.

Did it come across as sarcastic? I certainly didn't intend that, of course they have more important things to worry about. They'd usually come in to do a day's work and now suddenly everything is closed and they've got to write this weird open-ended letter.

It's an NHS dentist, so unless we have millions of deaths I expect the practice will continue to exist and receive funding as before. Such practices are funded partially on the basis of the number of patients who are notionally "theirs" to look after and that hasn't changed even if providing non-emergency services is not a priority now.

I think people might read the footer the first time they get an email. That's why it's there.

And on subsequent emails people only look for rough visual similarity as a sanity check. That's why scams keep it there.

>I just have no idea what to do about the rest of the world.

Assume that it's only going to get worse and act accordingly.

You need to expose that kind of stuff. By hiding them behind @agentname.com you just help them.

In this case wouldn't naming the agent also increase the likelihood that they're targeted? The clients have already been primed to follow the phishing link, so it'd just be a matter of getting a target list. Most agents I'm aware of stick to a local region/market, so targeted ad buys ("people in X county buying homes")/email lists/etc could be worth it for a motivated phisher.