Phishing attempt

[tng27]

I received this email a couple of times now. Paypal reports it as a phishing attempt. Thought you might be interested since it references my subscription payment to TGO:

---------------------------------------------------------------------

The payment for your subscription to ClubFrontier.org Supporting Membership Subscription failed because you do not currently have a back-up funding source for your instant transfer payment.AutoForums.com, Inc. has been notified of this failed payment.

We will try to make payment again on Apr 10, 2014.

To correct this problem, you must update your funding source to be an eCheck or a credit card.

Please change the funding source for this Subscription by clicking this link and following the steps below:
https://www.paypal.com/us/cgi-bin/?cmd=_subscr-find&alias=paypal@autoforums.com
1. Click the link above to go to log in and go to your Subscription Details.
2. Under 'Subscription Funding Source' choose a credit card or eCheck funding source from one of the drop-downs.

If there are no other funding sources available, add a new credit card:

3. Click on the 'Profile' subtab
4. Choose the 'Credit Cards' link from the Financial Information column 5. Click 'Add'
6. Follow the on-screen instructions to add a new credit card to your PayPal account

After adding a new credit card, follow steps 1 and 2 above to change your subscription funding source.



-----------------------------------
Subscription Details
-----------------------------------


Amount: $15.99 USD
Date of payment failure: Apr 5, 2014
Date of next payment attempt: Apr 10, 2014 Subscription Name: ClubFrontier.org Supporting Membership Subscription Subscription Number: S-4CY8527607207271A Item Number: cd33cf438c3a0e231cf480d9cdd3ee23





-----------------------------------
Contact Information
-----------------------------------


Business Name: AutoForums.com, Inc.
Contact Email: paypal@autoforums.com
Contact Phone: 416-341-8950

Sincerely,
PayPal


----------------------------------------------------------------
PROTECT YOUR PASSWORD

NEVER give your password to anyone, including PayPal employees. Protect yourself against fraudulent websites by opening a new web browser (e.g. Internet Explorer or Firefox) and typing in the PayPal URL every time you log in to your account.


----------------------------------------------------------------

Please do not reply to this email. This mailbox is not monitored and you will not receive a response. For assistance, log in to your PayPal account and click the Help link in the top right corner of any PayPal page.

PPID PP253 - f2c7820f1979d Edited April 5, 2014 by tng27

[TripleDigitRide]

How is this related to your TGO subscription?

[tng27]

I said it references the subscription. The scammers picked it up from somewhere - here, Paypal, or somewhere in between. I'm no interwebs expert

[sigmtnman]

I don't see anything about TGO in the message.  Where do you see a reference to TGO?

[tng27]

Crap sorry guys, I copied the wrong email. I got another one exactly like this except it says tngunowners instead of clubfrontier and the subscription amount is correct for tngunowners. I would guess the leak is on PayPal's end. Just wanted to give a heads up if anybody else got one.

[teecro]

When is the last time your computer was checked for Malware/Spyware? Not pointing one finger or another but I've used PayPal for at least the last ten years and the few scam emails I get claiming to be PayPal clearly look like scam email and land in my bulk folder...

[tng27]

I use Norton did a scan Last night. Would that find it or is there something better? Like you I've used paypal a long time & never have a problem. It seems odd that both incidents involved recent forum subscription renewals. Those aren't the only paypal transactions I've done lately but haven't seen anything on those. Weird

[teecro]

Try Malware Bytes even the free version works great and hardy any AV suite does a notable job on addware/spyware....

[tng27]

Thanks teecro. I'll give it a shot

[Oh Shoot]

The weirdest ones I've ever gotten are 2 or 3 in the last year, notices that "my order" has shipped, with a USPS tracking number.

 

The tracking number shows as generated on USPS site, but never go as far as accepted. Weird thing is that it can't be phishing, as there's no link for interaction. Actual email address is well spoofed too.

 

Never have figgered out what those could possibly be about.

 

I get the various "your PayPal accout needs updating" ones of course, but they're never related to any actual transaction. Have used PP for at least a couple of hundred grand over the years, never any hack directly related to an actual transaction.

 

Which suggests that the "leak" might be on your end, but of course couldn't say for sure.

 

- OS

Edited April 6, 2014 by Oh Shoot

[teecro]

Oddest ones I'm getting lately say my mortage is in collections....