If you bothered to peruse your spam folder a couple weeks ago you probably received this fraudulent email on March 6, 2003. The email, sent under the name info@paypal.com, was relatively well written would easily fool the average customer.

After the seemingly polite thief “apologized” for the inconvenience, the message directed recipients to login to their account to confirm their email address. A login screen was conveniently provided in the HTML message along with space for bank and credit card account numbers
 

After entering their username, password, and bank account info, users were redirected to the User Agreement at the real PayPal site (screenshot right), so there was no immediate realization you had just given up the keys to your account to some joker in Fresno or Timbuktu. Luckily PayPal confirms all transactions and profile changes with email messages, so those watching their email accounts would have seen unauthorized activity in time to notify PayPal before much damage occurred.

A bigger concern would be the bank account and/or credit card numbers provided in the lower half of the fake HTML email (see below). Hopefully, users naive enough to give those up contacted their financial institutions to close the effected accounts.

Full text of fraudulent email dated March 6, 2003.

After “logging in” via the fake email, the user was redirected to a legitimate PayPal page, though not the screen you would see if you had actually logged in. The scam artists could have written a script that would have actually logged users in to their own account, so there would be no suspicion