The Channel logo


By | John Leyden 11th August 2005 17:39

Fax-back phishing scam targets PayPal

Retro racket

Phishers have gone retro with a scam that tries to dupe victims into faxing their banking details to fraudsters. Scam emails, (screengrab) which pose as messages from online payment outfit Paypal, urge users to fax back account information instead of the more usual tactic of handing over details to a bogus website.

Would-be victims are told the information is needed to investigate an alleged security breach involving an attempt to reset their password (have the lads from Lagos developed a sense of irony here?). The scam email points to a Microsoft Word document on a Polish website. Recipients are instructed to download and complete with their bank account details (including PIN information), credit card numbers and login details before faxing back to what ostensibly appears to be a freephone number in the US. Sophos has confirmed that the telephone number mentioned in the emails is hosting an active fax machine. It's unclear whether the phone is actually located in the States or is being redirected elsewhere.

Sophos has reported the scam emails to eBay and is awaiting a response. "The phishing gang may have made a huge blunder by including the fax number in their scam. PayPal and the authorities are sure to follow that lead when investigating this matter further," said Graham Cluley, senior technology consultant for Sophos. "In the last few days we have seen a number of attempts by phishers to use this technique, and it's possible that some people who know that they need to be careful about entering their confidential information on a bogus website may think that completing and faxing back such a form is somehow safer."

He added that the change in tactics by phishers was likely an experiment possibly prompted by the effect of greater public awareness on response rates to conventional phishing scams. ®

alert Send corrections


Frank Jennings

What do you do? Use manual typwriters or live in a Scottish croft? Our man advises
A rusty petrol pump at an abandoned gas station. Pic by Silvia B. Jakiello via shutterstock

Trevor Pott

Among other things, Active Directory needs an overhaul
Baby looks taken aback/shocked/affronted. Photo by Shutterstock

Kat Hall

Plans for 2 million FTTP connections in next four years 'not enough'
Microsoft CEO Satya Nadella


League of gentlemen poster - Tubbs and Edward at the local shop. Copyright BBC
One reselling man tells his tale of woe