NWA-PCUG Newsletter Article, August 2006
PayPal and Pump and Dump Scams - Redeaux
By Ira Wilsker,
APCUG Director; Columnist, The Examiner, Beaumont, TX; Radio & TV Show Host

Iwilsker@apcug.net
(click to email author)


WEBSITES:
http://www.sophos.com/pressoffice/news/articles/2006/07/paypalvox.html
http://www.newsfactor.com/story.xhtml?story_id=02300000LV1G
http://www.paypal.com
http://www.computerworld.com/action/article.do?command=viewArticleBasic&arti cleId=9001612

EMAILS TO REPORT PAYPAL OR EBAY PHISHING:
spoof@paypal.com
spoof@ebay.com

It seems to me more than anecdotal that the number and cleverness of internet scams is increasing as the perpetrators become more sophisticated. As internet users become more aware of the online scams, and protective security software improves, offering an additional level of protection to users so protected, the crooks must find ways to overcome the users' suspicions and protection in order to perpetrate their nefarious activities. One of the most frequent targets of such identity theft and credit stealing activities are the members of the financial services company PayPal. PayPal has millions of members who use its services to pay for online purchases, and collect funds over the internet.

One recent version of a common identity theft scam directed at PayPal users, and widely disseminated via spam email, uses a novel method of tricking PayPal members into divulging their personal account information. Traditionally this type of "phishing" utilized masses of spam emails shotgunned to countless recipients. The emails alleged that the users' PayPal accounts had been jeopardized, and in order to reactivate the account, the user had go to an authentic appearing, but totally fraudulent copy of a PayPal website to verify his identity by entering his username, password, credit card number, expiration date, CVV2 security code from the back of the credit card, and ATM PIN number. Once this number had been entered onto the spoofed website, the victims PayPal and connected bank accounts can be accessed by the criminal, draining the funds of the victim. Almost exclusively the funds thus absconded end up overseas in Nigeria, Pakistan, China, Korea, or other countries where chances of recovery or prosecution are almost nonexistent. It should be noted that PayPal, a subsidiary of eBay, has a zero tolerance policy in terms of dealing with identity theft and fraud, and attempts to shut down any phishing scams directed towards its members. To help identify and terminate any such scams directed at PayPal users, PayPal has created an email address, spoof@paypal.com, that they have asked anyone receiving such emails to forward them to this address.

In a novel twist intended to overcome the resistance and suspicion that many of us have with some emails, along with the awareness that websites can be easily spoofed, a crook is utilizing an interesting method to trap victims. This method uses a phone number, rather than a website to ensnare victims. According to a recent article on NewsFactor Online, more than three percent of the people receiving these bogus emails will respond to a phone number, a rate higher than those who will go to a bogus website. The phone number listed is a "VoIP" number, where for a nominal fee, a domestic local number can be obtained for almost any area code, but this number when dialed can actually be connected to almost anywhere in the world. Once dialed, a recording announces, "Welcome to PayPal account verification. Please enter your 16 digit credit card account number", and proceeds to collect personal credit card information for illicit purposes. This phishing attack is novel not just in the way it collects the purloined information, but in the mechanics of the email itself. This particular email contains no text that can be read by a spam filter, but contains the message as a graphics file image that will slip through most spam filters and other defenses. Since there is no web link in the message that protective software can block, the message will likely be delivered to the recipient victim to be.

PayPal has taken steps to disconnect the illicit phone number in order to protect its members. In the recent NewsFactor article describing PayPal's attempts to fight this particular scam, a spokesperson for PayPal explained the company policy on victims of such scams. "PayPal will always reimburse all its users worldwide for unauthorized use of the PayPal account," said Sara Bettencourt, a PayPal spokesperson, quoted in NewsFactor Online. She recommends that if customers entered their account details after calling the bogus telephone number, they should log in on the PayPal site at http://www.paypal.com and change their passwords. Users should be aware that PayPal will never request personal financial data or accounts via email or phone.

Another email scam that has recently exploded in volume is the so call "pump and dump" or "touting trash" scams designed to entice investors into buying otherwise worthless stocks. According to a recent article in the security section of Computerworld, such stock scams are now making up about 15 percent of all junk emails. These scams start with a crooked investor purchasing a large block of penny stock, often in a worthless "shell company" not listed on any organized exchange, but instead listed in the "pink sheets" or posted on the over-the-counter (OTC) "bulletin board". Using a variety of email spam techniques, including the utilization of thousands of high jacked "zombie" computers, countless thousands of emails are sent out to potential victims bragging in glorious verbiage the explosive profit potential of owning this particular stock; this is referred to as the "Pump". Since there is no website or other link listed that can steal personal information, recipients are more inclined to open and read these illicit emails. As the greed gene starts to take effect, the unwary investor will call his broker to purchase this otherwise worthless stock. As the degree of volume increases on the buy side of the equation, and the scammer withholds his large quantity of shares from the market, a shortage develops, and the price of the stock rises substantially. As the price rises, the crook sells his shares into this increase, leaving the new investors holding the worthless stock just purchased at an unsustainable high price. This is the "Dump".

In a bizarre twist on this scam, the crook can spam millions of negative emails alleging horribly negative information about a stock, driving its price down as gullible investors either sell their shares, or "shorts" the stock (borrows stock to sell, hoping the price will decline). In a typical case of illegal price manipulation, as the price drops, the crook buys the newly depreciated stock, depriving the former owners of a portion of their net worth. As the false reports are proven invalid, the crook sells into the price increase, pocketing the profits at the expense of the former owners.

Beware of any emails from any financial services company telling you that your account is compromised, and needs to be verified, or your account access will be frozen. Be equally suspicious of a variation of this scam where financial institutions are offering a prize, typically $20 deposited into your account, for answering a few questions on a quality or satisfaction survey. In order to have your award deposited into your account, you must enter your credit card information, validation code, and PIN number, and the deposit will be made into your account. Yeah, right!

Finally, before purchasing any stock or similar investment, do your homework, and do not buy or sell stocks based on a hot get-rich-quick tip in an unsolicited spam email. Not just is that not cool, but it is the opposite; rather than cool, you will likely be burned - bad!

Click here to return to top



==================================================================