Simple clear advice in plain English

PayPal fixes phishing flaw

Online payment service changes code to block phishing attack

Paypal has blocked a sophisticated attack that tricked users of the online payment service into visiting a phishing site.

The flaw in the PayPal website allowed cyber-criminals to host a page on PayPal's website. The web pages appeared with a genuine SSL certificate to lull users into a false sense of security.

Malicious code on the fake page warned people that their PayPal account had been compromised. People were then redirected away from the genuine PayPal site to a phishing site hosted in South Korea.

Here victims were asked for their PayPal login information. According to internet monitoring company Netcraft, which first raised the alarm about the attack on Friday, people were also asked to enter their Social Security number and credit card details.

PayPal said as soon as it had been alerted to the flaw it changed some code on the PayPal website to block the scam. The online financial service also said it was working with the internet service provider that hosts the malicious site to get it shut down.

However PayPal said it had no idea how many people may have been victims of the scam.

Also see:
Fraudsters hijack PayPal's site in phishing attack

Reader Comments

alternative e-mail addresses

Paypal if they want an update of anyones account,should send the info to a customers alternative e-mail address and not the one supplied as a means of contact by the customer to paypal.This could be done by post and not on the internet,the foreign source could not then use this e-mail to CON paypals customers

Posted by Ray Stoner, 22 Apr 2007

   

Add your comment

All fields must be completed. Your email address will not be displayed or used to send marketing messages.

All messages will be checked by moderators before appearing on the site.

See our Privacy Policy for more information.

Related articles

fake-windows-security-alert

Cyber criminals launch their latest bogus Microsoft security alert

Links sent via email launch sophisticated and convincing phishing attack on Windows users, harvests users' email contacts

phishing-credit-card

Ticketweb users are being sent phishing emails following an attack on company's email server

Ticket-reselling company advises users not to click on links in emails from the company, allegedly offering an Adobe PDF, that is sent by cyber criminals

microsoft-hq

Microsoft reveals computer cold call scams still a problem

Microsoft has revealed a worrying trend that computer security cold-call scams are leading to wider fraud

Question & Answer

Q.Why are some of the keys on my keyboard doing strange...

> Read the answer

Q.Is my phone’s Bluetooth any use?

> Read the answer

Q.Can I switch boot drives so that I can work on older...

> Read the answer

Best deals on the web

img

Apple iMac 21.5" (MC309)

£926.40- Buy it now

img

Dell Inspiron 620 ST Intel Core i3-2100 3.10GHz / 3GB / 500GB / DVDRW / Win 7 Home Premium

£329.00- Buy it now

img

ZooStorm 7877-1023

£386.38- Buy it now

Latest issue & subscription deals

Poll

Are you concerned about viruses that target mobile phones?

Jargon Buster

Computing terms explained in plain English

Virtual drive

A set of files seen by Windows as a separate hard disk.

Great shopping deals from Computeractive