A phishing email scam that warns PayPal users of possible fraudulent account activity in hopes of scaring personally identifiable information out of them is currently making the rounds.
According to a blog post from ESET, the phishing emails falsely inform recipients that PayPal has detected “unusual activity” on their accounts and has “temporary limited what you can do” until the possible security issue can be resolved. Clicking the log-in button on these emails redirects victims to what appears to be a legitimate log-in screen – it even displays an SSL certificate to sell its supposed authenticity – but is actually a fake PayPal web page hosted on a malicious domain.
After victims “log in,” the fake PayPal site displays another message informing victims that they will not be able to withdraw funds for 15 days, unless the issue is addressed further. Those who click a "Continue" button to proceed are then asked to enter even more detailed information, including their Social Security number, address, phone number, birthdate and mother's maiden name.
As phishing scams go, this one is convincing, but there are still some clues that PayPal did not send this alert, ESET reported. For instance, the email contains minor grammatical and syntax errors, and the fake web page's request to enter your home country is unusual, considering it also asks for your Social Security number, which only applies to the U.S.
