PayPal phishing scam uses invoices sent via PayPal

Re:PayPal phishing scam uses invoices sent via PayPal by shaftway on Thursday August 18, 2022 @01:59PM (#32512870)

I had a form like that. You put in your email and it sends an email from [email protected], to [email protected], and to [email protected]. We had internal mailing lists for clients, including something like [email protected], but they were locked down so only certain people could send to them. Turns out [email protected] was one of those people, and so someone would spam all of our clients by putting their return address as [email protected]. We just took the form down and posted our email address.

[ Parent | on HN ]

Re:PayPal phishing scam uses invoices sent via PayPal by rtkwe on Thursday August 18, 2022 @05:57PM (#32515364)

Alternatively don't accept any internal @foo.com email addresses in your contact us form unless you're an email provider would work too.

[ Parent | on HN ]

Re:PayPal phishing scam uses invoices sent via PayPal by jrumbut on Friday August 19, 2022 @12:10AM (#32517491)

Have you ever seen anyone do that though?

The only real solution is not allowing contact form emails to be customized with free text input.

I guess you could have a manual approval loop for "weird" names (more than 30 characters, has a dot in it, etc) or other signs of spam. It would still leave some space for spamming though (I can't imaging a rule that stops "Buy More ETH" but doesn't stop any unusual real name).

[ Parent | on HN ]

Re:PayPal phishing scam uses invoices sent via PayPal by rtkwe on Friday August 19, 2022 @09:51AM (#32520933)

> Have you ever seen anyone do that though?

I don't know I haven't really probed random contact forms to see if they block this kind of thing.

There's a lot more to do to block this kind of proxy spam entirely for sure I was just talking about the particular problem of using the contact for to send to an mailing list.

[ Parent | on HN ]

Re:PayPal phishing scam uses invoices sent via PayPal by jrumbut on Friday August 19, 2022 @12:16PM (#32522913)

It's definitely evil genius stuff.

I'm sure enough organizations have a mailing list called "customers@company" or "clients@company" to make it worth a shot. Colleges probably have "students@school" or "faculty@school" list.

Might be enough names you can profitably do it by hand.

[ Parent | on HN ]

Re:PayPal phishing scam uses invoices sent via PayPal by toomanydoubts on Thursday August 18, 2022 @08:59PM (#32516630)

How did they know the internal mailing list address was [email protected]? Unless I'm missing something, sounds like this would require internal company knowledge.

[ Parent | on HN ]

Re:PayPal phishing scam uses invoices sent via PayPal by jabbany on Thursday August 18, 2022 @10:24PM (#32517068)

Maybe the spammer used to be a client and the internal mailing list name got leaked through an email they got.

[ Parent | on HN ]